Target Selection and Risk Assessment in Penetration Testing | A Guide for CEH Master Certification

Key takeaways

• Agree scope, timing and who is informed before any test starts, and put it in writing.
• Scope creep happens when testing drifts to systems nobody approved, so re-confirm before adding targets.
• Rate risk by likelihood and impact, so the client can decide what to fix first.

Table of Contents

• Penetration Test Planning
• Security Exceptions in Penetration Testing
• Risk Assessment in Penetration Testing
• Determining Tolerance in Penetration Testing
• Scope Creep in Penetration Testing
• Conclusion

Penetration testing is a core part of cybersecurity, helping organisations identify vulnerabilities before malicious hackers can exploit them. However, before launching a penetration test, security professionals must carefully plan and define the test’s scope, risk tolerance, and methodology.

Target selection, penetration test planning, security exceptions, risk assessment, tolerance determination, and scope creep are topics covered in the CEH Master certification syllabus.

Penetration Test Planning

Before executing a penetration test, it’s essential to outline key aspects such as the test type, scope, and constraints. The planning phase answers the following questions:

• How will the test be conducted? (Internal vs. External)

• Who will be aware of the test?

• What systems will be targeted?

• When will the test be scheduled?

• Where will the test take place? (On-site vs. Remote)

How: Internal vs. External Penetration Testing

The type of penetration test depends on the organization’s security goals and the environment being tested:

• Internal Testing: This simulates an attack from within the organization, assuming the attacker has gained some level of access to the internal network.

  • Example: An attacker who has stolen an employee’s login credentials tries to escalate privileges.

  • Approach: Usually a white-box test, where the tester has detailed knowledge of the internal network.

• External Testing: This focuses on public-facing assets, such as web servers, email servers, and externally accessible APIs.

  • Example: A hacker attempts to exploit a web application vulnerability to gain access.

  • Approach: Typically conducted as a black-box test, where the tester has no prior knowledge of the system.

Who: Social Engineering and Awareness Considerations

Organizations must determine:

• Whether the penetration tester is allowed to use social engineering techniques (e.g., phishing attacks, impersonation, pretexting).

• Which employees or security teams will be informed about the test to ensure realistic attack scenarios.

Example: If social engineering is permitted, an ethical hacker might send a phishing email to employees, attempting to steal login credentials.

What: Defining the Targeted Systems

The scope of the penetration test must be clearly defined to ensure:

• The tester knows exactly which systems can be tested.

• Critical infrastructure (such as financial databases) is protected.

• Third-party applications and cloud environments are considered.

Example: A company may exclude payment processing servers from testing due to potential legal or compliance issues.

When: Scheduling the Penetration Test

Timing is critical for minimizing business disruption. Organizations must decide whether to:

• Conduct the test during business hours, risking operational impact.

• Perform the test after hours, on weekends, or during holidays to avoid downtime.

Example: A retail company might prefer testing after peak shopping hours to prevent revenue loss.

Where: On-Site vs. Remote Testing

• On-Site Testing:

  • Provides full access to internal systems.

  • Allows physical security assessments (e.g., tailgating into secure areas).

  • Example: A penetration tester walks into a data center, attempting to bypass security controls.

• Remote Testing:

  • More cost-effective but limited by network restrictions.

  • May require VPN access or other remote access mechanisms.

  • Example: A tester attempts to gain access to an organization’s cloud infrastructure from an external location.

Security Exceptions in Penetration Testing

Security exceptions define rules and limitations for penetration testers. The type of test, white-box, black-box, or grey-box, determines what exceptions apply.

• White-box testing: The tester has full access to system details, including source code and network architecture.

• Black-box testing: The tester has no prior knowledge of the environment and must rely on reconnaissance techniques.

• Grey-box testing: The tester has partial knowledge (e.g., some credentials or documentation).

Security exceptions may include:

• Bypassing firewalls

• Using brute-force attacks (restricted in some environments)

• Exploiting vulnerabilities in live production systems

Example: A penetration tester is allowed to test internal networks but not customer databases due to privacy concerns.

Risk Assessment in Penetration Testing

A risk assessment identifies an organization’s most vulnerable areas, including:

• High-value data (financial records, intellectual property)

• Network infrastructure (routers, firewalls, cloud environments)

• Web applications and online services

• Physical security (access control, CCTV systems)

Risk Management Strategies

Once vulnerabilities are identified, organizations must decide how to handle them. The four main risk management strategies are:

1. Avoidance: Eliminating the risk by not engaging in activities that create it.

   • Example: A company disables USB ports on workstations to prevent malware infections.

2. Transference: Shifting risk to a third party, such as a cloud provider or cyber insurance company.

   • Example: A business outsources its DDoS protection to Cloudflare.

3. Mitigation: Reducing the impact of a risk through security controls.

   • Example: Implementing multi-factor authentication (MFA) to reduce credential theft.

4. Acceptance: Choosing to accept a risk if mitigation is too costly.

   • Example: A legacy system remains unpatched due to compatibility issues with critical business applications.

Determining Tolerance in Penetration Testing

Organizations must define which risks they can tolerate during a penetration test.

• Critical systems (e.g., real-time transaction databases) may be off-limits.

• Non-critical systems can be tested with controlled exploits.

Example: A hospital may allow testing on backup servers but restrict penetration testers from targeting live patient records.

Scope Creep in Penetration Testing

What is Scope Creep?

Scope creep occurs when new tasks or objectives are added to the penetration test after planning has been finalized. This can lead to:

• Increased costs

• Extended timelines

• Resource overload

Managing Scope Creep

To avoid scope creep:

• Define a clear testing scope before starting.

• Require formal approval for scope changes.

• Ensure additional tasks are documented and approved.

Example: A client initially requests network security testing, but later asks for a full web application assessment, significantly increasing the workload.

Conclusion

Penetration testing is a structured process that requires careful planning, defined scope, and risk assessment. Ethical hackers must determine which systems to target, who will be informed, and what security exceptions are allowed.

A thorough risk assessment ensures that organizations prioritize vulnerabilities and minimize disruptions. Managing scope creep prevents unexpected costs and project delays.

For CEH Master certification candidates, understanding target selection, risk assessment, and penetration testing methodologies is essential to becoming a successful ethical hacker.

To take this further with guided labs and an instructor, see our CEH v13 AI Master training.

Related reading

• Which Penetration Testing Method is Best? Black Box, White Box, or Grey Box?
• What is the difference between external and internal penetration testing?
• [2026] Top VAPT Interview Preparation

Reference

For the authoritative details, see NIST Special Publications.