A vendor quote that says "pentest" often means a scanner export with a logo on the cover. Three different jobs get sold under one word. If you are buying — or doing — the work, the distinction is the whole brief.
Three jobs people mix up
A security assessment maps what you have, which controls actually run, and what residual risk you accept. The output is a picture of the system: assets, trust boundaries, who can reach what. It does not require breaking in.
A penetration test is an authorized attempt to break a written scope. The output is evidence: a path that worked, what it reached, and how the owner can close it. Out of scope stays out — that is the contract, not a vibe.
A scan is an automated pass. Useful as a first cut. It is not a test of your people, your glue code, or the one endpoint nobody remembered to put behind the gateway.
If the statement of work does not name which of the three you are paying for, you will get the cheapest one.
What a real engagement produces
A useful report is boring on purpose. It names the asset, the condition, the impact, and a reproduction the owner can follow on a staging copy. A score without a path is a slide, not a finding.
It also says what was not tried. "We did not touch production payments" is a result. Testers who skip that line force the next team to guess.
This series stays on that side of the line: authorized work, written scope, no recipes for breaking systems you do not own. The rest of the pieces are about the desk we actually built — web review from the editor, tester OPSEC, timezone leaks in test accounts, sandboxed agents.
Where our tools sit
This is the desk we use when you order the work from us — assessment, authorized pentest, web review. The products stay open because we run the engagement on them, not because we outsource the thinking to a scanner.
Forge IDE is a deep Zed fork with our own AI Studio, a local UIDE store (vectors, documents, a knowledge graph on RocksDB), and built-in WebDriver: screenshots, DOM inspection, network monitoring, audits — over our MCP/JSON-RPC, not a browser plugin bolted on the side. That is the authorized web-review loop: same editor as the code, same notes as the finding.
When a review step is delegated to an agent, AGI Core is the runtime: a Rust kernel with a capability sandbox around every tool call, a persistent memory graph, and a planner you can watch over our WebSocket stream. An agent that can reach the filesystem without a grant is not an assistant — it is the next incident.
How to ask for the right thing
Write three sentences before anyone starts:
- Scope — hosts, apps, accounts, and what is off limits.
- Job — assessment, pentest, or scan. One word. Not two.
- Done — what artefact you will accept (evidence, map, or ticket list).
Then name the job in the mail. A scanner does not become a pentest because the slide says so. An editor with a real browser and a sandboxed agent runtime will not replace a skilled tester — they stop the tester from fighting the furniture.
What you can order from us
Zero Day Labs takes authorized security work — we use the same products described in this series, not a rented scanner PDF.
You can write to [email protected] or the contact form and ask for:
- a security assessment (map of assets, controls, residual risk);
- an authorized pentest on a written scope;
- a web application review (from the editor: DOM, network, evidence);
- a review of agent and tool isolation (what the agent is allowed to call);
- help making test fixtures honest (locale, timezone, exit address) so the report describes your system, not the tester's laptop.
Say which job you want, the scope, and what "done" looks like. We reply with a concrete proposal — same rule as the rest of the site.