External Testers and Teams for Overflow Pentest Work
Switch external testers on, make a team for each consultancy that takes your overflow work, and hand it an engagement: everyone in the team works on it, and nobody outside it sees it.
A busy month brings more engagements than testers. Pental lets you bring in external testers, one at a time or as a team from another consultancy, and hand them the overflow. Each external tester sees the work handed to them and nothing else of your firm’s: not your other clients, not another team’s engagements, and not your finding library unless you allow it. That is decided by your own database rather than the screen, so it holds whatever anybody tries in a browser. Security sets out how.
Switch external testers on
External testers are off for a new firm, and an administrator turns them on. Under Settings, Feature Modules, tick External testers and press Save Modules, or on Settings’ own External tab tick Enable external testers and press Save External Testers Setting. An External tab then appears in the sidebar beside Users, for administrators and seniors, and holds your teams and the library choice.
Off is a real switch, not a hidden menu. While external testers are off, an external tester’s account opens nothing, because your database answers as if they were nobody, and their own screen says External access is off. Switch them back on and their engagements are where they left them.
Invite an external tester
On the External tab, Add External Tester opens Add an External Tester with the External role chosen. Once you have teams, choose the Team to put them in, then press Add and invite. (Under Users, Add User does the same once you choose the External role.) They are emailed a link to sign in (untick Email them an invitation to add them without one, and send it later with Resend invite), and set up a second factor like everybody else, as adding your team, roles and multi-factor authentication describes. On the Portal’s price an external tester is one of your testers, like everybody who signs in for your firm.
Make a team for each consultancy
A team is a consultancy taking your overflow work. On the External tab, the External Teams card lists them: type the consultancy’s name and press Add team, then put its people in with Add an external tester. An external tester is in one team at most. Each team shows how many external testers it has and how many engagements are handed to it, and anybody in no team is named underneath, since they see only what they lead.
Hand an engagement to a team
On the engagement’s form, External Team chooses the team it goes to, or No team. Lead Tester lists your own people and then each team’s external testers under the team’s name, so the lead can come from the team doing the work. Everyone in the team sees the engagement and works on it: its findings, files, timeline, checklists and report sections. No other team sees it, and nor does any external tester outside the team.
Which client an engagement is for, and which team it is with, stay yours to change. Within the team, the lead can be handed from one of its external testers to another.
What an external tester sees
| Area | What an external tester sees |
|---|---|
| Dashboard and Assessments | The engagements they lead and the ones handed to their team. |
| Clients | The client each of those engagements is for, to read. The record stays yours to change. |
| Findings and files | The ones on their engagements, to write and change, and none from any other engagement. |
| QA Queue | Their own reports sent back by the reviewer, with the remarks to answer. |
| Library | Your finding library, while you allow it: every entry to read, and entries of their own to add. |
| People | Their own team, the lead and the reviewer on each of their engagements, and the people of those engagements’ clients. |
Everything else stays out of reach: your other clients and engagements, other teams, Settings, and your commercial areas.
Reports go through your QA
An external tester writes the report as any tester does and presses Submit for QA when testing is finished. The review is your firm’s: who reviews the report, taking it on, approving it and delivering it to the client. When a reviewer sends it back, the external tester sees the remarks on their engagement, answers them, and marks each one with Resolve. A reviewer’s remark stays in the reviewer’s words. The QA review covers the rest of the process, and a QA process for reports that survives a busy month is worth reading before the busy month arrives.
Your library, if you want it used
On the External tab, External testers can use your finding library is on to begin with, so a report an external tester writes for you starts from your house wording. They read every entry and can add their own, and an entry stays yours to change. Untick it and save the card, and external testers see none of it. The findings Library covers what goes into one.
When the overflow runs the other way
If your firm is the one taking overflow work from another consultancy, their clients expect their report. Keep that consultancy’s Word template beside your own and choose it for their engagements: reporting in another consultancy’s Word template walks through it.
Worth doing first
- Make the team before inviting its people, so each invitation puts them straight into it.
- Decide on the library now: on, external testers start from your wording; off, they start from a blank page.
- Hand a small engagement to a new team first, and sign in as one of its external testers to see exactly what they see.
Hand Your Overflow to a Team
Switch external testers on in the trial, make a team for a consultancy you work with, and hand it an engagement to see what its people see.
Only need the reporting? Our reporting tool is free and open source, on your own server.
Also Worth Reading
What Your Clients Actually See in the Portal
The client portal shows a client their own engagements, the findings you release, the documents you deliver and the checklists you share, and nothing else. What is on each screen, and what controls it.
WorkflowImporting Scanner Output as Findings
Bring a Nessus, Burp, OpenVAS, Qualys, Nmap or SARIF export into a phase of an engagement as findings: one for each issue with every host listed, in your library’s wording where it has the issue, and nothing written until you have seen it.
WorkflowChecklists and Runbooks for Every Phase of a Pentest
A methodology library of 22 checklists and 21 runbooks, from OSSTMM and PTES to OWASP and MITRE ATT&CK, suggested on each kind of phase once added, ticked by your testers, shown to the client if you choose, and moved in and out as Excel, Word or JSON.
Setup guide
Prefer to watch it?
The whole setup recorded, with chapters you can jump to: registering, your own domain, your own database in any of three places, your own mail server, branding, the first sign-in, updating the database on Supabase Cloud, and moving the database if you change your mind.
- 0:00 · Registering, signing in, and the free trial
- 0:44 · Your name and your firm’s name
- 0:50 · Custom domain
- +6 more