Pentest Team Diagnostic

Examine the team's actual work to establish what is driving delivery pressure and which decisions need attention.

ForOwners and practice leaders facing recurring rework or senior dependency.
The workReview evidence and test explanations with the people involved.
The resultFindings, priorities and next decisions, with uncertainties made clear.
Pentest Team Diagnostic

Find the cause behind the recurring problem.

A late report may reflect missing evidence, conflicting review standards or too little supervision. The same symptom can require a different intervention.

Simon examines a relevant sample of reports, QA comments and delivery records, then discusses how the work reached that point with the people involved. The review considers existing commitments and what the team can realistically change.

One rejected finding can point to different causes.

Illustrative example: a finding returns from QA because its severity explanation is incomplete. Reviewing the original evidence and asking the tester to explain the conclusion can lead to different responses.

The tester cannot explain the exploit's preconditions.
Technical instruction followed by supervised practice on those preconditions.
The explanation is sound, but the report leaves out a condition that changes its meaning.
A worked reporting example and feedback on the next draft.
The tester knew what to collect, but access expired before the evidence was captured.
An evidence check during testing and a review of the time allocated.
Reviewers require conflicting severity explanations.
Agreement between reviewers on the standard, supported by examples.

These are diagnostic starting points. More than one cause may apply; the team's work determines the response.

Read the worked training example

Agree what the review needs to establish.

Conversec takes responsibility for investigating the agreed questions, explaining the evidence behind its assessment and setting out recommended next decisions.

Your managers identify the concern, provide the agreed records and access to relevant people, and explain the constraints on delivery. We identify gaps in the evidence where a conclusion needs further investigation.

A basis for deciding what to do next.

The findings distinguish observed problems from explanations that still need checking. Priorities reflect the consequences of delay and the team's capacity to act.

  • Findings and the evidence supporting them.
  • Practices worth retaining and risks needing attention.
  • Prioritised recommendations and decisions for management.
  • Uncertainties, information gaps and any further investigation required.
  • Suggested evidence for assessing an agreed change.

See how the performance framework uses delivery evidence

Choose the support the findings justify.

Your team can implement the recommendations itself or discuss coaching or leadership support. A diagnostic is a separate engagement; it does not commit you to further work.

The scorecard can help identify an area worth investigating from your own assessment. A diagnostic examines the source work and tests explanations with the people involved.

Explore the optional self-assessment

Reducing dependence on senior pentest consultants

A confidential advisory engagement with a growing cyber security consultancy's offensive security function of approximately 20 testers.

This engagement combined operational diagnosis with advisory leadership and manager coaching. Internal managers retained day-to-day authority throughout.

The problem
Delivery and management practices were struggling to keep pace with growth. Sales and scheduling staff chased readiness, while senior technical consultants repeatedly stepped in to resolve client and delivery problems.
The judgment
The friction between teams came from unclear ownership and boundaries. Improving delivery required a shared understanding of responsibilities and stronger internal management.
Simon's responsibility
Simon led the diagnosis, developed a working maturity model, clarified consulting expectations and coached managers. Internal leadership retained responsibility for the management structure and day-to-day decisions.
Read the case study

Less pressure on senior consultants

By the end of an approximately four-month engagement, senior technical consultants were carrying less of the load from client friction and delivery problems.

More effective internal managers

Managers became more visible, took clearer ownership and handled issues that had previously escalated to senior technical staff.

A basis for continued development

The team gained a working maturity model and consulting skills framework to guide further improvement.

Simon's account of an advisory engagement, based on operational observations. The client is anonymised for confidentiality.

Read about the delivery work involved.

These articles work through reporting and management decisions relevant to the service.

How to measure penetration testing team performance

Measure pentest team performance using project and QA records alongside utilisation. Define each measure consistently and read related results together, allowing for engagement complexity and staffing changes. Start with a delivery problem the team needs to resolve, select measures that help explain it and review whether an agreed change improves the work.

Read article

How poor client communication erodes pentest margin

Poor client communication adds cost when people have to clarify an agreed scope, reconstruct findings or revisit decisions after delivery. On a fixed-price engagement, extra work reduces margin unless additional fees cover it. Record the time against the project and examine its cause before deciding whether the response belongs in scoping, reporting or account management.

Read article

What good QA looks like in a penetration testing team

Good pentest QA establishes whether the work is Actionable, Clear, Defensible and Correct. AC/DC gives testers and reviewers a shared basis for examining findings and delivery decisions. Apply it during testing as well as at report review, so missing evidence or an unexplained limitation can be addressed while the work is still in progress.

Read article

What keeps returning as a delivery problem?

Tell us what is happening, what it is affecting and what you have already tried. We can establish whether a diagnostic is appropriate.