Security Testing Authorisation

Security testing, including vulnerability assessment and penetration testing, can resemble unauthorised activity if it is not clearly sanctioned. Written authorisation protects both the client and Rysken, and ensures testing stays within agreed boundaries.

As part of onboarding, we confirm the following before any testing activity starts:

• Verification of the client’s identity and authority over the asset
• Written testing authorisation, signed by an appropriate representative
• Defined domains, URLs and assets in scope
• Defined excluded systems and data
• Agreed testing windows and permitted techniques
• Emergency contacts in case an issue arises during testing
• Evidence and reporting requirements
• Data retention and deletion terms

Each engagement is governed by agreed Rules of Engagement, which set out permitted testing techniques, timing, communication protocols and escalation procedures in the event of an unexpected issue.

Where a website is hosted or managed by a third party, the client is responsible for confirming they have the right to authorise testing, or for obtaining any additional permission required from their hosting provider.

For agency and white-label engagements, authorisation responsibilities, client communication and branding are agreed explicitly for each engagement and documented accordingly.

Questions about our authorisation process can be sent to hello@ryskensecurity.com.