Pentest Scope¶

The Pentests workspace turns an existing threat model into a structured penetration testing scope. It derives components, test cases, priorities, assets, compliance context, and risk links from the same report data used elsewhere in the threat model.

Open the workspace¶

Open a threat model and select Pentests, then select the Scope sub-tab. Populate the system context, DFD, threats, data assets, compliance frameworks, and risks first; an incomplete threat model produces a correspondingly limited pentest scope.

The scope is generated from current threat-model data. It is a read-only planning view and does not create verification tests or pentest findings by itself.

Pentest Scope derived from a threat model

Scope contents¶

Summary metrics¶

The header summarizes the number of components, zones, test cases, critical tests, data assets, and linked compliance requirements.

Scope definition¶

The scope section carries forward the system description, business criticality, out-of-scope items, and assumptions. Review these before handing the scope to a tester so the engagement boundaries are explicit.

Data assets at risk¶

Each data asset includes its classification and confidentiality, integrity, and availability ratings. Placements show which components hold the asset and whether it is encrypted. Transit gaps highlight unencrypted data flows.

Attack surface map¶

Components are grouped by zone, with the zone's type and trust level shown. Their associated threat counts and rating levels help testers understand which parts of the architecture deserve the most attention.

Testing priorities¶

Threats are grouped by rating level to form Critical, High, Medium, Low, and Info testing priorities. This preserves the threat model's prioritization rather than inventing a separate pentest score.

Test cases by target¶

Every active threat becomes a proposed test case under each thing it targets: a component, a flow, a zone, a boundary, or the whole system. The entry includes the threat number (T7), its description, STRIDE category, rating level, current status, and the relevant countermeasures with their numbers (C3). Flows show their type, and authentication is read from the flow's authentication list.

Compliance requirements¶

Linked frameworks and requirements show where testing may provide compliance evidence. The scope reflects the mappings currently present on the threat model; it does not assert that a test alone satisfies a requirement.

Risk cross-reference¶

Linked risk-register entries connect technical test cases to business risk. Use this section to explain why a finding matters and who owns the resulting response.

Keep the scope current¶

The view is recalculated from live threat-model data when it loads. Update the underlying model when scope or priorities are wrong, then return to Pentests to review the result. Avoid maintaining a second, conflicting source of truth outside the threat model.

Reconcile findings¶

The Reconcile sub-tab is currently a placeholder for comparing pentest findings with modeled threats and countermeasures. Finding reconciliation is not yet available through this workspace.

For the upstream analysis that feeds this view, see Creating a Threat Model and Threat Analysis.