The most expensive pentest is the one with unclear scope. Before active testing, outside-in clarity pays: which domains and services are visible? What is no-go? What should the test prove? CASP and clean RoE prep reduce blind flight and renegotiation.
A release in 6 weeks needs evidence. We clarify: goal “regression safety login+API”, no-gos (prod payment), windows, contacts, stop criteria. Optional CASP on staging because shadow endpoints were unclear. RoE signed, then active testing. Without this prep, day one would have been scope fighting only. Figures and names are anonymised; the flow matches typical engagements. Decision criteria stay explicit. No ranking or lead guarantees apply.
Good pentests rarely fail on tooling — they fail on prep. We require approval and RoE — customer protection, not bureaucracy. That is intentional and part of the positioning.
This page’s job: Owns preparation and RoE before active testing. CASP is optional, not forced; not a substitute for the vs-pentest page.
What should be written before the first active step:
What the test proves — and what it does not.
Hosts, apps, APIs, accounts — IDs and environments.
Payments, prod data, partner systems …
When testing is allowed, how aggressive.
24/7 or business hours, stop path.
PoC format, confidentiality, retest option.
Without an outside-in picture and written approval boundaries, scope creep, production risk, and findings nobody can map to the goal appear. Then the pentest feels “expensive and unclear” — because prep was missing.
Security, IT, and procurement planning an authorised pentest who still need to sharpen scope, goals, and proof purpose.
The most expensive pentest is the one with unclear scope. We help sharpen purpose, no-gos, and optional outside-in — and we do not start blind testing in production without approval and RoE.
What should the test prove? Compliance evidence, release gate, or targeted validation?
Windows, contacts, stop criteria, and allowed actions before the first active step.
Outside-in when exposure is unclear — not as a forced upsell.
We refuse “just go live-fire” without approval.
Typical boundaries before active testing:
Scope/RoE clarification and optional CASP prep
Declining unclear or unauthorised active tests
Clean handoff into the authorised pentest
Immediate active testing without approval “due to time pressure”
Guarantees of criticals or zero downtime
Selling CASP as a silent substitute for the pentest
If you want to prepare and approve a pentest cleanly: scope meeting. If you want unlimited immediate attack without rules, we decline.
Method boundaries first — no mixed CASP/pentest theatre.
A pentest with clear goals and mappable results.
Optional outside-in + RoE + approval.
Prep saves rework during active testing.
Provide goals, contacts, no-gos — we structure.
Exposure and business risk steer scope.
No-gos and windows upfront.
CASP prep and pentest deliverables stay separate.
Sharpen outside-in.
Goals, limits, windows.
Active testing after approval.
Where included in the offer.
What should the pentest prove?
CASP for exposure clarity.
Written, clear, accountable.
Only in approved scope.
No, but often useful when exposure is unclear.
Authorised domain/system owners in writing — details in scope.
Rules of engagement: allowed actions, windows, contacts, stop criteria.
Contact with test purpose; optional CASP link and pentest page.
Not always, but often wise. Prod-only needs stricter windows and no-gos.
Change and approval — no silent expansion. Otherwise results and liability are unclear.
CASP and penetration testing are often mixed — that wastes budget. We separate them: CASP is passive outside-in profiling with authorisation; a pentest is active, approved scope with RoE and PoCs. So you know what is worth doing first.
Open topic →Without verifiable domain authorisation, SHELL-AFFECT does not start CASP. DNS-TXT verification ensures only owned or written-approved domains are viewed outside-in — for trust, scope, and clear responsibility before any passive security analysis begins in a DACH context.
Open topic →An outside-in assessment at SHELL-AFFECT is CASP: a passive view of the externally visible attack surface, only after domain authorisation, with analyst accountability and a signed report. Orientation for leaders and IT before budget flows into active testing or unclear tool waves.
Open topic →Share goal and timing — we propose prep and scope.