Most companies book a penetration test when the deadline is already close. Looking back, the warning signs were usually there for weeks. Someone mentioned a questionnaire, a renewal date crept closer, or a customer asked a polite question that went unanswered.
If any of the signs below sound familiar, a fast pen test may be worth considering now, while you still have room to choose well.
1. A client has asked for a pen test report
When a customer asks for evidence of independent testing, they usually mean it. A deal can sit paused until the report arrives. Ask what they need to see, and by when, before you do anything else.
2. A tender or contract names a CREST test
Some clauses specify the accreditation, the scope and even how recent the test must be. These details decide what you can buy. Read the wording closely and ask the buyer to clarify anything vague.
3. A security questionnaire has an empty pen test box
Vendor questionnaires have a way of stalling at the same question: “When was your last penetration test?” Leaving it blank, or answering “never”, slows the whole review. A booked test with a confirmed date is better than silence.
4. Your cyber insurance renewal is coming up
Insurers increasingly ask what security checks a business carries out. Evidence of testing can affect the questions you’re asked, and sometimes the cover on offer. Check your renewal date and work backwards from it.
5. A major release or launch is close
New features, new APIs and new integrations all introduce new ways to go wrong. Testing before launch is far cheaper than fixing a public problem afterwards. It also means any findings can be fixed in the release rather than patched later.
6. Your infrastructure has just changed
A cloud migration, a new hosting provider or an acquisition can quietly widen what’s exposed to the internet. Old servers get left running, and ranges change hands. If your environment looks different from last year’s, last year’s test no longer describes it.
7. Your last test is more than 12 months old
Many buyers and frameworks treat anything older than a year as out of date. Even where nobody asks, a stale report tells you little about your current systems. If the date on yours makes you wince, that’s your sign.
8. An investor or partner is doing due diligence
Funding rounds, acquisitions and supplier onboarding all involve someone checking your security. They tend to ask late and expect answers fast. Having a recent report on hand turns an awkward request into a quick reply.
9. You’ve had an incident or a close call
A phishing attack that nearly worked, a strange login or a confirmed breach all raise the same question: what else is open? Testing after an incident helps you find related weaknesses rather than assuming the first problem was the only one. If you’re mid-incident, deal with that first and book testing once things are stable.
10. A compliance scheme needs evidence
Frameworks such as ISO 27001, SOC 2 or PCI DSS often expect regular independent testing, and auditors usually ask for proof. Missing a test before an audit can mean delays or follow-up actions you could have avoided. Check which controls your scheme requires and when the evidence is due.
What to do next
Spotting the sign is the easy part. These five steps help you act on it without panic.
- Read the requirement. Find out exactly what’s being asked for: the accreditation, the scope, the date, and whether a report or a letter will do.
- Define the scope. List the applications, IP ranges and environments that matter most. A short, honest list beats a vague “everything”.
- Sort authorisation and access. Know who can sign the rules of engagement, whether a hosting provider needs to approve, and make sure test accounts work for each user role.
- Ask providers for dates. Request the earliest start, the testing window and the report delivery date in writing, rather than a general turnaround time.
- Plan backwards from the deadline. Subtract the testing days, the reporting time and a buffer. If the maths doesn’t work, speak to whoever set the date before it becomes a crisis.
Some of these will take an afternoon, and some depend on other people. That’s why starting early matters more than finding the quickest provider.
Final thoughts
Rarely does one sign appear on its own. A client request, an ageing report and an approaching renewal often turn up together. Treat them as a prompt to act rather than a reason to panic, and you’ll usually find there’s more room than you feared. If you’d like to see what’s realistic for your own deadline, you can ask about a fast pen test and get a straight answer on dates.
