Hiring guide
Penetration testing liability, read from the buyer's side
Penetration testing liability is the part of the contract that says who carries which risk. Testing touches live systems, so the question is real. However, most of the protection comes from paperwork signed before any testing starts.
- Signed scope before testing
- Fixed price agreed in writing
- OWASP and PTES methods
Where penetration testing liability starts
The first protection is authorization. A test run without the system owner's signed permission is unlawful under laws such as the US Computer Fraud and Abuse Act guidance, whatever the contract says. So the signed scope comes before any liability clause matters.
Then the rules of engagement reduce risk further. Testing windows, limits and pause rules make disruption less likely in the first place.
The clauses that shape penetration testing liability
Read each clause with one question. If something goes wrong, who pays, and how much? Then check that the answer is the same for both sides where it should be.
Also ask legal to read the clauses together. Because caps, exclusions and indemnities interact, one clause alone can mislead.
| Clause | What it does |
|---|---|
| Limitation of liability | Sets a cap, often linked to the fee |
| Exclusions | Lists losses neither side covers |
| Indemnity | Says who covers third-party claims |
| Authorization warranty | Buyer confirms it may authorize the test |
| Confidentiality breach | Often outside the cap |
Penetration testing liability checklist
Tick what your contract review has covered.
Your result appears here as you tick, so you can see what is still open.
The authorization warranty
Most contracts ask the buyer to confirm that it owns the systems, or holds the owner's written permission. That clause matters, because the firm relies on it.
Therefore check every system in scope before signing. If a supplier hosts one, get its consent in writing first.
Penetration testing liability and confidentiality
A leaked report can do more harm than a disrupted system. So many agreements treat confidentiality breaches differently from other claims.
Also check data destruction. If nothing is retained after delivery, the exposure ends when the work ends.
Reducing penetration testing liability in practice
Name the fragile systems and exclude or limit them. Keep a reachable contact during the window. Agree the pause rule in writing.
As a result, the contract becomes a backstop rather than the main defense.
Our position
We test only systems you own or are explicitly permitted to test, under a signed scope, written authorization and rules of engagement. Zero client findings are retained after delivery.
Full engagements run from $35,000 to $120,000, and the floor is $25,000. The bounded Focused Exposure Review starts at $4,500. Its fee is credited in full against a full engagement commissioned within ninety days. One fixed number is agreed after the scoping brief, and it never moves during the project. The method follows the Penetration Testing Execution Standard.
Penetration testing liability questions
Who carries penetration testing liability if a system goes down?
The contract decides, usually with a cap. Rules of engagement make it less likely.
What is an authorization warranty?
The buyer confirms it may authorize testing of each system.
Is confidentiality inside the cap?
Often not. Check how your agreement treats it.
How can we reduce penetration testing liability?
Exclude fragile systems, keep a contact reachable and agree a pause rule.
Related guides
Review penetration testing liability before signing
Send a short brief and your standard terms. We reply with a written scope, our terms and one fixed number.
Get a fixed price