The scanner dump problem
A scoped test and an unreviewed tool export can arrive in the same shape of document. Our illustrative report (PDF) shows the evidence quality to expect. It is an example built from synthetic findings, not a client report.
Scanners vs Manual Testing
| Dimension | Automated Scanner | Manual Pentest |
|---|---|---|
| Flaw Target | Outdated libraries, missing headers, static CVE signatures. | Broken object-level authorisation (BOLA/IDOR), multi-step state machine bypasses, tenant boundary leaks. |
| Auth Context | Coverage depends on configured authentication, supported flows and session handling. | Tests authenticated role pairs (User A vs User B, Member vs Admin) for horizontal and vertical privilege escalation. |
| Exploit Chaining | Reports potential weaknesses that need context and validation. | Chains subtle flaws (e.g. open redirect + CORS misconfiguration + internal SSRF) into cluster access. |
| Noise Ratio | Results require triage; accuracy varies with tooling and configuration. | Manually verified evidence, impact and practical reproduction steps where safe. |
How to Scope Modern Perimeters
Avoid giving vague scopes like "one web app and five APIs." To get fixed-price, defendable quotes, specify three vectors:
- Web applications: the distinct roles and the multi-step workflows that matter.
- APIs: endpoint count by write versus read, plus an OpenAPI spec.
- Cloud: account boundaries, assume-role policies and egress controls.
Each vector is priced differently, and the service pages set out what each one covers: web application penetration testing, API penetration testing and cloud penetration testing. Where the cloud question is about configuration rather than exploitability, a cloud security review finds more per hour than a test does.
Pre-Engagement Checklist
Copy and run through this setup before kickoff so test hours are spent finding vulnerabilities instead of debugging credentials.
================================================================================
SORAMI: PENTEST PRE-ENGAGEMENT CHECKLIST
================================================================================
1. ENVIRONMENT & DATA
[ ] Staging environment has parity with production code and configuration.
[ ] Outbound email and SMS notifications redirected to test sinks (Mailtrap/blackhole).
[ ] Production database sanitised (no raw customer PII in staging).
2. ACCESS & TEST ACCOUNTS
[ ] Two accounts per role created (Role A Tenant 1, Role A Tenant 2, Role Admin)
to verify horizontal and vertical authorisation boundaries.
[ ] Test authentication and MFA approach agreed securely. Do not share production secrets.
[ ] OpenAPI spec, GraphQL schema, or Postman collection provided.
3. NETWORK & WAF
[ ] Tester egress IP addresses allowlisted in WAF, Cloudflare, and firewalls.
[ ] Custom testing header agreed upon:
X-Security-Assessment: Sorami-Engagement-2026
4. EMERGENCY & RULES OF ENGAGEMENT
[ ] Escalation contacts (mobile/Slack) agreed for immediate critical alerts.
[ ] Formal "Stop-Test" trigger protocol agreed upon (e.g. agreed error-rate threshold).
================================================================================
What a Real Deliverable Looks Like
A useful pentest report is concise. It contains:
- Executive summary: business impact and exploitability in one page.
- Reproduction steps: an engineer can follow the evidence safely.
- Patch advice: the specific controller, ORM or IAM policy to change.
- Retest terms: Agree the findings, window and conditions for verifying fixes in writing.
Need a direct technical scoping call?
Tell us what you are running. We review the architecture, confirm scope, and provide a fixed quote without sales bureaucracy. Service page: penetration testing.
Talk to an engineer