Security Testing Authorisation
Last updated: 13 November 2026
Rysken only performs security testing against assets for which the requesting party has confirmed ownership or authority, and only within a clearly agreed, written scope. This policy explains what that process involves.
1. Why Written Authorisation Is Required
Security testing, including vulnerability assessment and penetration testing, can resemble unauthorised activity if it is not clearly sanctioned. Written authorisation protects both the client and Rysken, and ensures testing stays within agreed boundaries.
2. Before Testing Begins
As part of onboarding, we confirm the following before any testing activity starts:
- Verification of the client’s identity and authority over the asset
- Written testing authorisation, signed by an appropriate representative
- Defined domains, URLs and assets in scope
- Defined excluded systems and data
- Agreed testing windows and permitted techniques
- Emergency contacts in case an issue arises during testing
- Evidence and reporting requirements
- Data retention and deletion terms
3. Rules of Engagement
Each engagement is governed by agreed Rules of Engagement, which set out permitted testing techniques, timing, communication protocols and escalation procedures in the event of an unexpected issue.
4. Third-Party Hosting and Infrastructure
Where a website is hosted or managed by a third party, the client is responsible for confirming they have the right to authorise testing, or for obtaining any additional permission required from their hosting provider.
5. White-Label and Agency Engagements
For agency and white-label engagements, authorisation responsibilities, client communication and branding are agreed explicitly for each engagement and documented accordingly.
6. Contact
Questions about our authorisation process can be sent to hello@rysken.com.