Scoping tool
Which test do you actually need?
“Penetration test” is used to describe several very different pieces of work. Answer six questions and we will tell you which one fits, why, and what will shape the scope — including when the honest answer is that you do not need a penetration test at all.
The same answer, by hand
Match your situation to a service
If you would rather read than click, this is the whole routing table.
Testing & assessment
Penetration Testing
Use this when a product, release or system needs manual testing that proves real, chained impact.
View serviceMobile Application Security
Use this when the app is the product, or a customer is asking for mobile-specific assurance against a recognised standard.
View serviceCloud Penetration Testing
Use this when your AWS, Azure or GCP estate has grown or migrated and needs hands-on assurance.
View serviceAI / LLM Penetration Testing
Use this when a product has embedded AI or LLM features and nobody has tested who can reach the controls behind them.
View serviceActive Directory & Internal Network
Use this when you need to know how far one compromised laptop or account could reach.
View serviceVulnerability Assessment
Use this when you need a validated baseline across a large estate, or a recurring view of it.
View serviceCompliance-Driven Pen Testing
Use this when ISO 27001, SOC 2, PCI DSS, DORA or NIS2 requires independent testing evidence.
View serviceAdversary simulation
Red Teaming
Use this when your controls are mature and you need to know whether you would detect a real attack.
View serviceThreat-Led Penetration Testing
Use this when you are a financial entity preparing for DORA TLPT or a TIBER-EU test.
View servicePurple Teaming
Use this when your SOC, EDR or SIEM is in place and you want to validate its detections.
View serviceSocial Engineering & Phishing
Use this when you need evidence of how staff and processes respond to phishing, vishing or pretexting.
View serviceThreat Intelligence
Use this when leaked credentials, phishing sites or brand abuse could be targeting you beyond your perimeter.
View serviceBuild & research
Secure Development
Use this when a new product or major redesign needs threat modelling and code review before launch.
View serviceVulnerability Research & Exploit Dev
Use this when you build or rely on a product and need unknown vulnerabilities found before attackers do.
View serviceSecurity Toolkit
Use this when your team needs security automation or tooling that does not exist yet.
View serviceWhat this tool will not do
It will not price your engagement, promise a date or estimate effort. Six answers are not enough to do any of those honestly, and a tool that pretends otherwise is selling rather than scoping. It also cannot tell you what an auditor, assessor or competent authority will accept: PXLSec is an independent offensive-security firm, not an auditor, assessor or certification body. What the tool can do is point you at the right conversation and tell you which questions to prepare for it.
FAQ
Questions we're often asked
Is this a quote?
No. It is a starting point, and deliberately a conservative one. The tool has six answers to work with; a senior tester reading your actual environment will have hundreds. Treat the result as the service to talk about first, and the scope drivers as the questions worth preparing before that conversation.
Why does it sometimes recommend a vulnerability assessment instead of a penetration test?
Because that is sometimes the honest answer. If nobody yet knows what is exposed across a large estate, a penetration test on one guessed target is a worse use of money than a validated picture of the whole thing. We would rather say so here than discover it halfway through an engagement.
We think we need a red team. Why is it recommending a penetration test?
A red team operation measures whether you detect and respond to an attack. If the systems it would run against have never been tested by hand, the operation will succeed through the first obvious weakness it meets and you will learn very little about your defenders. Coverage first, then the adversary view.
Does answering this commit us to anything?
Nothing is sent anywhere until you choose to send it. The questions are answered in your browser; if you use the prefill button, your answers are written into the enquiry form on this page so you can read, edit or delete them before submitting.
Our situation does not fit any of these answers.
That is common, and it is a good reason to just write to us instead. Describe the environment in your own words and a senior tester will reply with questions and a proposed approach.
Send us what the tool suggested.
Send a short description of your environment and goals. A senior tester, not a salesperson, will reply with questions, a proposed approach and a quote.