Prepare for a penetration test by agreeing on goals, scope, and written authorization, then fixing known flaws, backing up systems, and warning the vendors and staff who need to know. Plan on 3 to 4 weeks.
I’m the Lead vCIO at Uprite. We run penetration tests as part of our cybersecurity services in San Antonio, so we gain when you book one. Our penetration testing in San Antonio page shows how we run it. We still want you ready. Tests are scoped in tester days. If the tester waits a day for a password, that day comes out of your budget.
A penetration test goes well when the paperwork and the environment are ready before the tester starts. Agree on scope and rules, sign an authorization letter, list your assets, fix the known critical flaws, test your backups, and tell the vendors who need to know. CISA added 313 known exploited vulnerabilities to its catalog in the last 12 months, so patch those first.
What does a penetration test need from you before it starts?
A penetration test is an authorized attempt to break into your systems the way an attacker would, followed by a written report. NIST SP 800-115 is the federal guide to planning and running technical security tests. The tester only checks what you let them touch. That’s why your preparation decides how useful the result is.
The table lists the 10 steps in order. Steps 1 to 3 are decisions. Steps 4 to 6 are work on your own systems. Steps 7 to 10 cover people, vendors, and the time after the report.
| Step | What you do | When | Who owns it |
|---|---|---|---|
| 1. Name the reason | Decide whether the test is for a rule, an insurer, a customer, or your own peace of mind | 4 weeks out | Owner or IT lead |
| 2. Write the scope | List what’s in, what’s out, and which data matters most | 4 weeks out | IT lead with the tester |
| 3. Sign the rules and authorization | Put systems, dates, source addresses, and off-limits actions in writing | 3 weeks out | Someone with authority to sign |
| 4. Build the asset list | Collect domains, public addresses, subnets, apps, cloud tenants, and admin accounts | 3 weeks out | IT lead |
| 5. Fix the known problems | Patch exploited flaws, kill default passwords, turn on MFA | 2 weeks out | IT lead or MSP |
| 6. Back up and test a restore | Prove a restore works and list fragile systems | 1 week out | IT lead or MSP |
| 7. Tell your vendors | Check hosting, cloud, and monitoring terms and give notice where needed | 2 weeks out | IT lead |
| 8. Name contacts and a stop word | Two people on your side, reachable the whole time | 1 week out | Owner |
| 9. Decide who knows | Brief managers, clear any phishing or on-site work with HR, legal, and the landlord | 1 week out | Owner and HR |
| 10. Plan the aftermath | Book the findings call, the fix time, and the retest | Before kickoff | Owner and IT lead |
How do you set the goal, the scope, and the rules?
Start with the reason for the test. It sets how deep the tester goes and what the report looks like. The FTC Safeguards Rule covers firms like CPA practices and car dealers. It requires an annual penetration test and vulnerability assessments every 6 months unless the firm monitors continuously. PCI DSS also asks for internal and external tests. The standard is behind a download on the PCI Security Standards Council library, so read the current text before you quote it. An insurer or a customer usually wants a report dated this year.
If you’ve never run a vulnerability scan, run one first. Our guide on penetration testing versus vulnerability scanning explains why a scan is often the better first purchase.
Next comes the scope. List the targets in plain terms. A typical list has your public addresses, your office network, a web app or two, and your Microsoft 365 tenant. Some tests add Wi-Fi or staff phishing. List what’s off limits too. The tester can’t know that the old phone system in the closet is off limits unless you say so.
Tell the tester which data would hurt most to lose. The Texas Attorney General’s breach report list shows 25 filings from San Antonio-area organizations between November 7, 2025 and November 6, 2026. Fifteen affected fewer than 5,000 Texans. The median was 3,394. Seventeen included medical information. These were small and mid-size organizations, not giants. If the tester knows where your patient files or client Social Security numbers sit, they can spend their days there instead of on the guest Wi-Fi.
What should the authorization letter say?
Never let a tester start without a signed letter. Without one, the work isn’t a test. The letter names the systems, the dates and hours, the testers, and the addresses their traffic comes from. It also lists what you forbid, such as denial of service or copying real customer records. A tester should prove access with a harmless file, not with your data.
The signer has to own what’s being tested. Microsoft’s rules of engagement say testing must stay inside your own tenant or assets you have explicit authorization for. If a vendor hosts a system, your signature doesn’t cover it.
Put the stop conditions in the letter. Say what happens if the tester finds signs of a real attacker already inside. The test pauses, and the tester calls your contact. Write that down now so nobody has to improvise.
How do you build the asset list?
Collect every domain you own, every public IP address, the internal subnets, the web apps, the cloud accounts, and the admin accounts that can change them. Give the tester that list as a starting point, not a boundary. Forgotten servers are some of the best findings a test produces. Ask the tester to report anything they reach that isn’t on your list.
If nobody has built that list before, it takes a while. Our free network assessment produces a current network diagram and a device-by-device asset register. You keep both even if you buy nothing else, and they work well as input for the scope. Our cybersecurity risk assessment guide for San Antonio covers the same ground from the risk side.
The tester will want a few more items at kickoff. This is the pack I’d hand over.
- Your signed authorization letter and the scope document.
- An asset list and a network diagram, even if it’s out of date.
- A low-privilege user account, and an admin account if you’ve chosen a deeper test.
- A list of fragile systems that need gentle handling.
- Both emergency contacts with cell numbers.
- Vendor terms you checked for cloud and hosted systems.
Should you fix everything before the test?
No. Some checklists say to fix everything, and I disagree. If you fix every known issue first, you pay a tester to confirm your scan results. Fix what a scanner would find in an hour. A tester billed by the day shouldn’t spend one of those days proving that an unpatched VPN exists.
Start with CISA’s Known Exploited Vulnerabilities catalog. It added 313 entries from November 2025 through October 2026. Of those, 29 carry a ransomware flag. Compare the list with the products you run. Patch the matches. Change default passwords. Turn on MFA for every admin account and every remote access path. CISA also offers free cyber hygiene vulnerability scanning for qualifying organizations, which finds the obvious items cheaply.
Leave the rest for the tester to find.
The money works like this. The median ceiling rate across 441 penetration tester listings on GSA federal schedules, pulled November 5, 2026, was $155.78 an hour, or about $1,246 for an 8-hour day. That’s a federal benchmark, not an Uprite quote. At that rate, one idle day uses 33% of a 3-day test, 20% of a 5-day test, and 12.5% of an 8-day test. Small tests lose the most to delay.
What should you do about backups and fragile systems?
Test a restore a week before the tester arrives, and write down the result. A penetration test can crash a weak system. The usual suspects are an old file server or a business app on unsupported software. Tell the tester which systems are fragile. They’ll handle those carefully or leave them out.
Take a snapshot or a fresh backup the day before. Our disaster recovery planning for San Antonio page explains how we approach restore tests. If a restore has never worked, fix that before the test.
Which vendors need to know about the test?
It depends on who owns the system. The table shows what the two big clouds publish today.
| System | What the provider’s published rules say | What you do |
|---|---|---|
| Microsoft 365 and Azure | No advance notice. Test only your own tenant or assets you’re authorized to test. Denial of service and reaching other customers’ data are prohibited. | Keep the scope inside your tenant and keep the authorization letter on file |
| Amazon Web Services | No approval for the listed services. Command and control testing and simulated events need approval, and AWS asks for 2 weeks of notice. Denial of service, flooding, and S3 bucket takeover are prohibited. | Check your services against the list and send the request early if it’s needed |
| Software run by another company, such as payroll or practice management | Set by that vendor’s contract | Read the terms or ask in writing, and leave it out of scope if you can’t get a yes |
| Your own managed security provider | Set by your agreement with them | Decide whether to warn them, as described below |
The rows come from Microsoft’s page and the AWS penetration testing policy. Both pages change, so read them again the week you test.
You also have to decide whether to warn your monitoring provider. If you tell them, they won’t raise an alarm or start incident response against your own tester. If you don’t, you learn whether they’d catch a real attack. I’d tell one senior person on their side and nobody else. That way the test still measures detection. Our managed security services in San Antonio team takes that call for our own clients.
Who should be on call during the test?
You need two named people with cell numbers who can answer within minutes. One can approve a pause. The other can restart a server. They don’t need to watch the test. They do need to pick up the phone.
Agree on a stop word too. Any word works. Everyone on both sides should know that the tester halts when it’s said. That sounds like theater until a server stops responding.
Who needs to be told inside the company?
Brief the managers whose teams will see odd activity. Don’t brief everyone. A phishing test only works if staff don’t know about it. Get HR and legal to approve any phishing or phone tests before they start. If the test includes walking into your office, check your lease. A San Antonio office park with a shared lobby may have a rule about it.
What happens after the report?
Book the findings call before the test begins. Block time for your IT lead to fix the top items. Ask for a retest slot so someone verifies the fixes. A report that sits in a folder is a common waste. Our tests end with a ranked fix list and a rescan until the items are closed. I’d look for the same from any provider.
Send us the reason for the test and a rough list of what’s in scope. We’ll tell you what the tester will need from you and quote by scope.
Request a Penetration Test QuoteQuestions to settle before you sign the scope
How long does it take to prepare for a penetration test?
Plan on 3 to 4 weeks for a company with a reasonable asset list. The slow part is usually getting written authorization from a third party, not the technical work. Cloud tenants and hosted vendors add time, so start with those.
Do I have to tell Microsoft or Amazon before testing?
Microsoft doesn’t require advance notice for testing your own tenant. AWS needs no approval for its listed services but does for command and control testing and simulated events, and it asks for 2 weeks. Check both pages the week you test.
Can a penetration test crash my systems?
Yes, though it’s rare when the scope names fragile systems and the tester avoids denial of service. Old servers and unsupported software are the likeliest to fall over. Back up the day before and keep both contacts reachable.
Do I give the tester passwords?
It depends on the question you want answered. A test with no credentials shows what an outsider can do. A test that starts with a low-privilege account shows what a stolen staff login can do, and for most small companies that’s the more useful one.
Should I fix findings before the test starts?
Fix the obvious ones, meaning exploited vulnerabilities, default passwords, and missing MFA. Don’t try to fix everything. If a scanner would find an issue in an hour, a tester shouldn’t spend a billed day on it, but the unknowns are what you’re paying them to find.
Who has to sign the authorization letter?
Someone with authority over the systems being tested, usually the owner or an officer. If a vendor hosts a system, the vendor has to agree as well. Your signature can’t authorize testing of equipment you don’t own.
What does a penetration test cost in San Antonio?
Plan on about $3,700 to $18,700 for a test of 3 to 15 tester days. That’s the GSA median of about $1,246 a day multiplied out, and it’s a benchmark and not a quote. Uprite quotes each test by scope after we see what’s in it.
