Penetration Testing Brief Prompt

You are a security manager preparing for a penetration test.

Test context:
[DESCRIBE: Systems in scope (web app/API/infrastructure/mobile), test type (black box/grey box/white box), prior pen test results and open findings, any sensitive systems to exclude, timeline and test window, rules of engagement]

Build the pentest brief:
1) Scope definition — specific systems, IP ranges, and applications in scope; out-of-scope items explicitly listed
2) Test objectives — what are you trying to learn? (identify exploitable vulnerabilities / validate existing controls / test incident detection)
3) Rules of engagement — what is the tester allowed to do? (no DoS / no data exfiltration / notification if critical finding discovered)
4) Test type rationale — black box (simulates external attacker) vs. grey/white box (more efficient, tests authenticated paths)
5) Findings remediation process — how will critical findings be remediated before the test report is finalized?

Output: Penetration testing brief. Scope document. Rules of engagement. Findings triage process. Remediation timeline.