> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Penetration Tests

> Manage penetration testing programs with provider integration, finding tracking, and automated evidence collection.

## Overview

The Penetration Tests module lets you plan, execute, and track penetration testing engagements directly in Matproof. Connect your testing provider, import findings, track remediation, and automatically link results as evidence against the relevant compliance controls.

Penetration testing is required or recommended by most compliance frameworks:

| Framework | Requirement                                                                  |
| --------- | ---------------------------------------------------------------------------- |
| DORA      | TLPT (Threat-Led Penetration Testing) every 3 years for significant entities |
| ISO 27001 | A.18.2.3 - Technical compliance review                                       |
| SOC 2     | CC7.1 - System monitoring and penetration testing                            |
| PCI DSS   | Requirement 11.4 - Annual penetration testing                                |
| NIS2      | Article 21 - Testing effectiveness of cybersecurity measures                 |

<Note>
  Navigate to **Penetration Tests** in the sidebar to access the module.
</Note>

## Creating a test engagement

<Steps>
  ### Define the scope

  1. Go to **Penetration Tests - New Test**
  2. Enter the engagement details:
     * **Name** - descriptive label (e.g., "Q1 2026 External Infrastructure Test")
     * **Type** - External network, internal network, web application, API, mobile, social engineering, or TLPT
     * **Scope** - list the systems, networks, or applications being tested
     * **Provider** - select your testing provider or enter a new one
     * **Scheduled dates** - start and end dates for the engagement
  3. Save the engagement

  ### Execute the test

  The testing provider conducts the engagement. During the test period, the engagement status shows as **In progress** in Matproof.

  ### Import findings

  After the test completes:

  1. Open the engagement
  2. Click **Import findings**
  3. Upload the provider's report (PDF, CSV, or JSON formats supported)
  4. Matproof parses findings and creates individual records for each vulnerability

  You can also add findings manually if needed.
</Steps>

## Finding management

Each finding contains:

| Field                 | Description                                                            |
| --------------------- | ---------------------------------------------------------------------- |
| **Title**             | Short description of the vulnerability                                 |
| **Severity**          | Critical, High, Medium, Low, Informational                             |
| **Description**       | Detailed description including the attack vector and impact            |
| **Affected asset**    | Which system or application is vulnerable                              |
| **Status**            | Open, In remediation, Remediated, Accepted, False positive             |
| **Remediation owner** | Team member responsible for fixing the issue                           |
| **Due date**          | Target date for remediation                                            |
| **Evidence**          | Proof of remediation (screenshot, configuration change, retest result) |

### Remediation workflow

1. Review imported findings and assign owners
2. Set remediation due dates based on severity:
   * Critical: 7 days (recommended)
   * High: 30 days
   * Medium: 90 days
   * Low: next scheduled maintenance window
3. Owners update the finding status as they work through fixes
4. Upload remediation evidence (configuration changes, patches applied, retest results)
5. When all findings are addressed, mark the engagement as **Completed**

<Warning>
  Do not mark critical or high severity findings as **Accepted** without documenting a risk acceptance rationale. Auditors will scrutinize accepted findings, especially for frameworks that require active vulnerability remediation.
</Warning>

## Provider integration

Matproof integrates with penetration testing providers to streamline finding import:

* **Manual upload** - upload the provider's report in PDF, CSV, or JSON
* **API integration** - for providers with API access, configure automatic finding sync

To configure a provider:

1. Go to **Settings - Integrations - Penetration Testing**
2. Select your provider or add a custom one
3. Follow the setup instructions for API-based sync

## Linking to compliance controls

Penetration test results serve as evidence for multiple framework controls. To link findings:

1. Open a completed engagement
2. Click **Link to controls**
3. Matproof suggests relevant controls based on the engagement type and findings
4. Confirm the mapping - the engagement summary and finding status become evidence on those controls

<Tip>
  Set up recurring test engagements (quarterly or annually) and link them to the same controls. This creates a continuous evidence trail that demonstrates ongoing testing over time.
</Tip>

## Scheduling and reminders

Stay on top of your testing program:

1. Go to **Penetration Tests - Schedule**
2. Set up recurring reminders (e.g., "External pentest due every 12 months")
3. Matproof sends notifications 30 days before the next test is due
4. Track compliance with testing schedules from the dashboard

## Reporting

Generate penetration test summary reports:

1. Open a completed engagement
2. Click **Generate report**
3. The report includes: scope, findings by severity, remediation status, and timeline
4. Export as PDF for management review or audit evidence