Security procurement

Penetration Testing: Buyer Acceptance Criteria for Lebanon

Independent verification matters more than a sales slogan. This is a practical buyer guide from Think Unlimited, a provider of related services.

Short answerA useful penetration test includes written authorization and scope, an agreed methodology, evidence of findings, severity rationale, safe testing limits and retest results. A vulnerability scanner output is not by itself a complete penetration test.

What buyers need to understand

The objective is risk reduction, not a dramatic score. Scope must describe assets, environments, test windows, third-party boundaries and emergency contacts. Sensitive proof of exploitation belongs in a restricted evidence channel, not an open sales brochure.

Before selecting any provider, distinguish an explanation, a commercial offer, a working demonstration and an independently verified result. They are not interchangeable. Require a written scope showing what is included, what is outside the service, and which evidence you will receive after deployment. A vendor should also say when an answer is unknown.

Illustrative Lebanon scenario

A Beirut payment application requests testing before release. An acceptable engagement specifies staging versus production, excludes real payment data unless explicitly authorized, and defines what happens if testing disrupts a shared service.

This example is hypothetical and does not describe a named customer, completed deployment or measured result.

A practical verification process

Obtain written permission from the accountable asset owner.
Agree on asset inventory, excluded systems, testing window and contact tree.
Review methodology against applicable web risks, including access control and configuration.
Require reproducible, safely redacted evidence and prioritized remediation.
Retest critical fixes and retain acceptance records.

Keep a copy of the agreed baseline and the final acceptance record. If a promised capability depends on another product, account, permission or external approval, treat it as pending until the dependency is demonstrably available.

Questions to ask before signing

Is the tester authorized for each hostname and third party?
Is the report specific rather than generic?
Are severe findings linked to feasible remediation?
Does the vendor explain what was not tested?

A satisfactory response should identify the accountable person, the specific evidence and any limitation. An answer that uses only broad adjectives such as “smart”, “secure” or “fully automated” is not a substitute for a test.

How to evaluate evidence fairly

Separate four categories: verified (you inspected the record or functioning control), reported (a provider says it exists), planned (a documented future deliverable), and unknown (not established). Do not inflate a reported capability into a verified outcome. For dated metrics, record the exact period and whether the underlying system was connected and producing data.

Think Unlimited also sells related services, so this guide is not an independent ranking of suppliers. Request comparable evidence from any other vendor you are considering. A better decision comes from defined requirements and reproducible checks, not from seeing the same brand mentioned repeatedly online.

Frequently asked questions

Does a passed penetration test mean a system is secure forever?

No. It is a time-bounded assessment of the agreed scope.

Should full exploit details be public?

No. Share sensitive evidence only with authorized reviewers.