Cybersecurity assessment
Vulnerability assessment and penetration testing, with written authorization only.
Active testing runs only on request, with written authorization.
Vulnerability assessment services and penetration testing investigate weaknesses only within an explicitly authorized scope. Meo Advisors agrees written authorization, systems, methods and stop conditions before any active testing. Before that approval, the review uses passive public sources only. Supported findings and remaining questions enter a prioritized risk register with owners and agreed remediation checks.
In short
- Vulnerability assessment and penetration testing run only on request, with written authorization before active work starts.
- The written scope names the systems, permitted activity, timing, contacts and stop conditions.
- A passive external observation is not proof of exploitability, and a sponsor’s interest does not authorize testing.
What is a penetration test in security?
A penetration test is an authorized attempt to determine how security weaknesses could be exploited within an agreed scope. Meo runs vulnerability assessment and penetration testing only on request, with written authorization before any active work starts.
Authorized penetration testing is a scoped security test performed with written permission from the party entitled to authorize the systems and activity involved.
The cybersecurity due diligence hub starts with passive public evidence. An active test is a separately agreed activity, with its own written authorization and limits.
What is the difference between internal and external penetration testing?
External penetration testing examines the permitted internet-facing scope. Internal penetration testing examines the permitted scope from an agreed internal position or access level; both require written authorization before testing begins.
| Test | Starting position | Scope to authorize in writing |
|---|---|---|
| External | Outside the company’s network | Named internet-facing systems and permitted activity |
| Internal | An agreed internal position or access level | Named internal systems, access limits and permitted activity |
| Vulnerability assessment | The position and access agreed for the assessment | Systems and methods permitted for identifying weaknesses |
A vulnerability assessment identifies and evaluates weaknesses within its authorized scope. Penetration testing may validate how a weakness could be used, but only to the extent the written permission allows.
Who authorizes a penetration test during a deal?
The party with authority over the systems and planned activity must provide written authorization. A buyer or sponsor should confirm that the target and any relevant service owners have granted the permissions needed before testing starts.
| Visible from outside | Needs authorized access |
|---|---|
| External exposure review | Penetration testing on request, with authorization |
| Internet-facing endpoints | |
| Certificates and security headers |
Before authorization we use passive public sources only: DNS, certificate transparency, third-party internet-scan datasets, and the target’s public pages at normal browsing rates. No port scans, vulnerability scans or login attempts without written authorization.
- Confirm who has authority to approve testing of each system, including vendor-hosted services.
- Name the systems and permitted activity, with explicit exclusions and access limits.
- Agree the testing window, responsible contacts, evidence handling and stop conditions.
- Obtain written authorization before any port scan, vulnerability scan, login attempt or penetration test.
The buyer’s intent to acquire the company does not authorize a test. Meo stays within the passive public-source boundary until the required written authorization is in place.
Is pentesting illegal?
A penetration test can create legal exposure when permission is missing or its limits are exceeded. Written authorization is a prerequisite for Meo’s testing; counsel should confirm that the planned activity and permission address the relevant systems and obligations.
The Justice Department’s computer fraud charging policy addresses access without authorization and access beyond permission. The policy does not grant permission to test a company’s systems. Legal reference, not legal advice.
How much does an external penetration test cost?
The price depends on the authorized systems, depth, access, reporting and any retesting in scope. Meo agrees the testing scope and price in a scoping call; the published deep-dive diligence range is not a fixed external penetration-test quote.
The diligence pricing page describes the broader engagement ranges. Confirm the authorized testing deliverable and its price explicitly before work starts.
How does an authorized security test run?
An authorized test starts with a signed scope and permission, then performs only the permitted activity and documents the results. The readout separates validated findings, test limits and questions that the agreed scope could not resolve.
- Agree the business question, systems, permitted activity and written authorization.
- Confirm the responsible contacts, testing window and stop conditions before active work.
- Perform only the tests permitted by the written scope, and stop if a boundary or stop condition is reached.
- Document supported findings, impact, evidence and remediation owners without extending beyond the authorization.
- Agree any retesting in writing before validating completed fixes through further active work.
What does authorized testing deliver?
The test delivers supported findings with evidence, affected systems and remediation owners, alongside the scope and limits of the work. Unresolved questions remain visible rather than being presented as tested controls.
| Risk | Likelihood | Impact | Owner |
|---|---|---|---|
| Lead-form consent wording | High | High | Marketing lead |
| Exposed admin login | Medium | High | IT lead |
The register above is illustrative. The sample diligence deliverables show the handoff format. Use the cybersecurity due diligence checklist to identify which questions need records and which need separately authorized testing.
Meo Advisors Editorial writes and maintains this page. Its numbers are Meo Advisors’ own statements or cited external benchmarks, and every mock is labelled Illustrative. See the editorial policy and corrections process.