Penetration testing assesses exploitation within agreed boundaries. Cyber hygiene covers everyday access, updates and backups. They complement each other; reports do not guarantee that every possible attack is prevented.
Define authorisation and boundaries
Record systems, addresses, methods, timing and stop contacts. Partner infrastructure needs relevant permission. Separately authorise availability-sensitive scenarios.
For example, assess test-portal permissions using prepared accounts to avoid unnecessary real data.
Check foundational controls
Inventory exposed services, administrative rights and unused accounts. Remote administration needs agreed protection and restrictions. Configure multifactor authentication alongside account recovery.
Review updates, guest-network isolation and backup access. Antivirus does not replace these controls, and no single measure provides absolute protection.
Assess findings in context
Automated warnings need validation and impact assessment. Reports should show conditions, evidence, affected assets and remediation. Restrict access to sensitive evidence.
Priorities depend on exposure, privileges, data and business context. Agree owners and action dates rather than rely only on scanner severity colours.
Retest after changes
Retest fixes and relevant neighbouring scenarios. Explicitly record remaining risks and untested areas. Security maintenance continues after a one-off assessment.
ALL IT Agency outcomes follow the agreed scope: validated findings, recommendations and retest evidence. Promising complete invulnerability would be misleading.
Sources and further reading
