如何从一个坏的网络讲一个良好的网络渗透测试？
you really can’t, just in the same way you can’t really tell if a colonoscopy was a good one. the best way to ensure you have a “good” penetration test is to verify that the vendor has an independent attestation to the quality of their methodology and the individuals doing the testing.(e.g., crest certification).
应使用基于风险的方法来确定渗透测试的范围。您需要保护哪些资产？从谁？这些资产在哪里驻留（例如，云，dmz，外部/公共系统，内部网段）？什么法律/法规适用（例如，pci-dss）。这些基本问题将有助于框架笔测试范围。