Scope
The explicit definition of what a security test may target and what is off limits.
Scope lists the addresses, domains, applications, and physical locations in play, along with exclusions such as production systems that cannot tolerate disruption.
Scoped too narrowly, a test misses the path a real attacker would take. Attackers do not honor scope, so anything excluded should be a deliberate risk decision rather than an oversight.
Where this comes up
Scope sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Rules of engagement The agreed conditions for a security test: timing, permitted techniques, escalation contacts, and stop conditions. Penetration test An authorized simulated attack against your systems to find and demonstrate exploitable weaknesses before a real attacker does. Attack surface Everything about your organization that an attacker could potentially reach and attempt to exploit.