Penetration testing and security audits
Arrange annual or on-demand testing with explicit authorization, rules of engagement, reporting, and retesting.
Penetration testing is a scoped engagement performed under written authorization. Guard includes an annual engagement in its service coverage and supports additional on-demand work; the accepted agreement defines the target set, effort, and deliverables.
Request an engagement
At Assessments → Penetration tests → Request engagement, enter the business owner, assets, testing objective, desired dates, and environment. Supply written permission for assets operated by third parties. The engagement coordinator confirms the scope before work is scheduled.
Review Engagement → Rules of engagement with the tester and service owner. Record allowed techniques, excluded systems, test accounts, source addresses, hours and time zone, data-handling limits, emergency contacts, stop conditions, and the approval authority for changes. Production disruption, social engineering, and destructive testing require explicit scope; they are not implied by a general request.
During testing
Use Engagement → Timeline to review status and findings. The tester records a critical issue through the agreed urgent contact path instead of waiting for the final report. The owner can select Request pause and contact the listed emergency coordinator; the request is not proof that all tester activity has already stopped. Confirm the acknowledged pause before treating the test as inactive.
A scope extension requires a reviewed revision and renewed authorization. Updating an asset tag does not expand the testing contract. Keep scanner schedules and defensive controls visible to the testing team so intentional activity is distinguishable from unrelated attacks.
Close and retest
At Engagement → Deliverables, review technical findings, executive summary, tested scope, exclusions, methodology, and evidence handling. Assign remediation owners, revoke temporary accounts and network allowances, and schedule a retest for agreed issues. An annual engagement is not a continuous guarantee that every application revision was tested.
Security audits at Assessments → Audits → Request review evaluate the agreed controls and evidence set. Reports can support customer and auditor review; they do not themselves grant a certification or establish compliance with every applicable obligation. Use reports to export the approved audience-specific deliverables.