Cybersecurity · 9 min
Authorized pentest scope
Written permission is the first control, not paperwork after the fact.
Testing someone else's system without permission is not 'hacking practice'. It is illegal. Training at Shefa does not authorize you to test networks you do not own.
A usable authorization names the legal entity, the assets (hosts, apps, cloud accounts), the window of time, and the techniques that are allowed or forbidden. 'Check our security' is not a scope.
Production data, third-party SaaS, and customers' privacy change the work. If you cannot say whose data might be touched, you are not ready to test.
The point of a pentest is exploitable paths with evidence and a way to fix them. A pile of scanner output without a human reading the business context is a vulnerability assessment wearing a costume.
We start only when the letter exists. If you are a student, the same rule applies to labs: use systems built for you, or written permission. Curiosity is not consent.
Request an assessment when you own the systems or you can get that letter. We will help you write the letter. We will not skip it.