What to Expect When You’re Expecting Pentesters
Penetration tests often fail before testing begins: unclear scope, missing access, vague expectations, and teams that are not ready to act on the findings. This talk covers the real-world parts of pentesting that do not show up in CTFs or exploit write-ups: scoping calls, messy asset lists, delayed credentials, defensive reactions, and reports that never become remediation work. Using anonymized consulting examples, we will look at how to prepare for a pentest, stay engaged during testing, and turn findings into actual security improvement.
This talk is about how to get more value from penetration testing by understanding what happens before, during, and after the technical work.
We will cover common reasons engagements go wrong: unclear scope, confusing terminology, missing access, unrealistic expectations, poor communication, and weak remediation ownership. The goal is to help attendees understand that a good pentest is not just about finding vulnerabilities; it also depends on preparation, communication, and follow-through.
Slide Layout
- What a pentest is and is not
- Authorized, time-boxed testing
- Not a magic wand or guarantee
- Why scope matters
- Why pentests fail before they start
- Vague requests
- Unclear asset inventories
- Confusion between apps, APIs, scans, and red teams
- Missing credentials or test data
- Real scoping examples
- A well-prepared client
- A moving-scope client
- A client who mixed compliance, SDLC, and testing needs without a clear goal
- Human factors
- Findings can feel personal
- Defensive reactions slow down remediation
- How to keep the conversation focused on impact instead of blame
- During and after the test
- Kickoff and status calls
- Escalating high-impact findings
- Assigning owners
- Tracking remediation
- Looking for root causes and finding chains
Andrew Wade is a Principal Security Consultant with NCC Group, where he leads and delivers penetration testing and cloud security engagements across application, container, Kubernetes, and cloud environments. He also leads NCC Group’s Cloud Security Community of Practice and guides the global Cloud Security Practice, including service design, delivery standards, scoping improvements, and consultant enablement.
Andrew’s work sits at the intersection of hands-on technical testing, practice leadership, and client advisory. He focuses on helping organizations turn security testing into clearer risk understanding, better remediation decisions, and more mature security programs. Prior to cybersecurity consulting, Andrew worked in academic research and university teaching, bringing a background in anthropology, communication, and human behaviour that directly informs his perspective on why penetration testing succeeds or fails in practice.