A vendor quote that says "pentest" often means a scanner export with a logo on the cover. Three different jobs get sold under one word. If you are buying — or doing — the work, the distinction is the whole brief.
The problem
In a commercial proposal, “pentest” often means a scanner export with a logo on the cover. Three different jobs are sold under one word — and the client gets the cheapest.
What we did
Separated the three jobs by goal and deliverable: security assessment (a map of assets and residual risk), pentest (a sanctioned attempt to breach the scope) and scanning (a first cut). Described what a useful report looks like and the three sentences to agree before starting.
What came out
A brief for the client: name in the contract which of the three jobs you pay for, what “done” means and what was left untouched. A scanner does not become a pentest because a slide says so.
Three jobs people mix up
A security assessment maps what you have, which controls actually run, and what residual risk you accept. The output is a picture of the system: assets, trust boundaries, who can reach what. It does not require breaking in.
A penetration test is an authorized attempt to break a written scope. The output is evidence: a path that worked, what it reached, and how the owner can close it. Out of scope stays out — that is the contract, not a vibe.
A scan is an automated pass. Useful as a first cut. It is not a test of your people, your glue code, or the one endpoint nobody remembered to put behind the gateway.
If the statement of work does not name which of the three you are paying for, you will get the cheapest one.
What a real engagement produces
A useful report is boring on purpose. It names the asset, the condition, the impact, and a reproduction the owner can follow on a staging copy. A score without a path is a slide, not a finding.
It also says what was not tried. "We did not touch production payments" is a result. Testers who skip that line force the next team to guess.
This series stays on that side of the line: authorized work, written scope, no recipes for breaking systems you do not own. The rest of the pieces are about the desk we actually built — web review from the editor, tester OPSEC, timezone leaks in test accounts, sandboxed agents.
Where our tools sit
This is the desk we use when you order the work from us — assessment, authorized pentest, web review. The products stay open because we run the engagement on them, not because we outsource the thinking to a scanner.
Forge IDE is a deep Zed fork with our own AI Studio, a local UIDE store (vectors, documents, a knowledge graph on RocksDB), and built-in WebDriver: screenshots, DOM inspection, network monitoring, audits — over our MCP/JSON-RPC, not a browser plugin bolted on the side. That is the authorized web-review loop: same editor as the code, same notes as the finding.
When a review step is delegated to an agent, AGI Core is the runtime: a Rust kernel with a capability sandbox around every tool call, a persistent memory graph, and a planner you can watch over our WebSocket stream. An agent that can reach the filesystem without a grant is not an assistant — it is the next incident.
How to ask for the right thing
Write three sentences before anyone starts:
- Scope — hosts, apps, accounts, and what is off limits.
- Job — assessment, pentest, or scan. One word. Not two.
- Done — what artefact you will accept (evidence, map, or ticket list).
Then name the job in the mail. A scanner does not become a pentest because the slide says so. An editor with a real browser and a sandboxed agent runtime will not replace a skilled tester — they stop the tester from fighting the furniture.
We do all three jobs ourselves — from an editor with a real browser inside (Forge IDE) and with agents that cannot step outside their grant (AGI Core). Tools don't replace the specialist; they stop getting in the way. If you are not sure which of the three you need, start with an email — we will help you write the scope.What you can order from us
Zero Day Labs takes authorized security work — we use the same products described in this series, not a rented scanner PDF.
You can write to [email protected] or the contact form and ask for:
- a security assessment (map of assets, controls, residual risk);
- an authorized pentest on a written scope;
- a web application review (from the editor: DOM, network, evidence);
- a review of agent and tool isolation (what the agent is allowed to call);
- help making test fixtures honest (locale, timezone, exit address) so the report describes your system, not the tester's laptop.
Say which job you want, the scope, and what "done" looks like. We reply with a concrete proposal — same rule as the rest of the site.
Products in this article
Order the right job
Security assessment, pentest or a web-app review — tell us what you have and what “done” means.
Pentest OPSEC: your laptop is in the evidenceScreenshots, HAR files and support tickets from a test keep your home IP and clock. Authorized testers treat the laptop as part of the fixture — not as 'just my machine'.
Web security review from the editorMost authorized web reviews die in the gap between the IDE and a pile of browser windows. Forge IDE keeps the code, the live page and the notes in one process.
VPN Chrome extension: what it protects and what it doesn'tA Chrome VPN extension is a proxy for browser traffic only. What it really protects, where it leaks, and when you need a full VPN app instead.