Authorized Testing Policy

Security testing does not begin without written authorization from a person who controls the systems being tested.

Authorization must be recorded in signed Engagement Documents before any active testing begins.

The written scope must identify:

• the client and authorized representative;
• each approved domain, subdomain, application, API, IP address, repository, account, and environment;
• systems and services that are excluded;
• any approved user roles or test accounts; and
• special operational, confidentiality, or data handling restrictions.

Changes to approved assets or access levels require written confirmation before the changed scope is tested.

The Engagement Documents must state the testing period, allowed and prohibited methods, emergency contacts, stop procedure, and any provider requirements.

Unless the signed Service Agreement states another period, authorization remains valid for 30 days from signing or until testing is completed, whichever occurs first.

Testing uses nondestructive methods. Testing stops at proof of concept when further exploitation would add operational risk or expose more information than needed to validate a finding.

Denial of service, destructive activity, social engineering, persistence, malware, production data alteration, and other high-risk methods are excluded unless expressly approved in writing with appropriate safeguards.

The client must own each system in scope or hold valid authority from its owner. It must also obtain any permission required from hosting providers, software providers, business partners, or other third parties.

ThreatNest does not contact a hosting provider, content delivery network, or other third-party service on the client's behalf without prior client consent.

Evidence of authority may be requested. Testing is refused or stopped when ownership or permission cannot be confirmed.

Connected or embedded third party systems remain out of scope unless their owner or provider has granted permission. This includes payment services, externally operated patient portals, cloud services, content delivery networks, analytics platforms, scheduling tools, and other hosted applications.

A potential concern involving an out-of-scope integration may be documented without actively testing that system. Testing stops if it reaches an unintended system, and the designated client contact is notified.

The client may request an immediate pause or revoke authorization through the emergency contact method in the signed Service Agreement.

Testing may be paused or stopped when:

• authorization is withdrawn, disputed, or no longer clear;
• unexpected instability or operational impact occurs;
• a system owner or provider objects;
• sensitive information is unexpectedly exposed;
• scope information is inaccurate;
• continued work may be unlawful; or
• continuing would create unreasonable risk.

Testing resumes only after the issue is resolved, the scope remains safe, and written authorization is still valid.

Questions about authority, scope, unexpected impact, or exposed sensitive information must be reported through the agreed emergency contact as soon as possible.

A validated critical issue may be reported to the designated contact before the final report. The client remains responsible for operational, legal, and regulatory decisions in response.

Engagement findings are confidential and are not publicly disclosed without written permission or a binding legal requirement.