What gets tested?
You decide the scope. It might be a website, a mobile app, an internal network, cloud accounts or a mix.
Agree the rules of engagement in writing. These cover test dates and times, systems that are off limits, emergency contacts and how testers handle any data they reach.
Decide how much the testers know at the start. In a black-box test they start with little information, like an outside attacker. In a white-box test they get access and details, so they can go deeper in the same time.
How long does it take?
It depends on the scope. A single web app takes less time than a large network with many systems. Your provider should give you a timeline before work starts.
Plan for three phases. First you agree the scope and rules. Then the testers do the work within the agreed test window. Last, they write up the report.
Good testers keep you informed along the way. If they find a serious issue, they should tell you right away and not wait for the report.
What is in the report?
Most reports open with a short summary for leaders. It explains the overall risk in plain terms.
The main section lists each finding, ranked by risk. For each one you should see what was found, how it was found, what an attacker could reach and the steps to fix it.
Ask for enough detail that your team can repeat the issue. That makes fixes faster and lets you confirm them later.
What happens after the test?
Fix the most serious findings first. Give each fix an owner and a due date.
Ask the testers to retest once fixes are in place. A retest confirms each issue is closed.
Keep the report secure. It describes how to reach your weak points. Share a summary with the people who need it, such as leaders or auditors.