Engagement Management · Topic 3 of 5
Collaboration and Communication
See how pen testers use peer review, escalation paths, deconfliction and clear risk language to work safely with clients, defenders and stakeholders.
- 5 min
- The communication plan lists contacts, emergency numbers, update schedule and secure channels.
- Critical findings, signs of a live intruder and accidental outages are communicated immediately.
- The escalation path says who to contact next when the first contact does not respond.
What it is
A penetration test is a team activity between testers, the client's technical staff and its business leaders. Collaboration and communication cover how these people share information, raise problems and agree on decisions during the engagement.
Good communication prevents outages, avoids false alarms and makes sure the final message reaches the people who can fix things. The exam focuses on peer review, escalation paths, status updates and explaining risk.
How it works
The communication plan
The plan is agreed during scoping and written into the rules of engagement (ROE). It names primary and backup contacts, an emergency number, the schedule of status updates and the secure channel for sharing findings.
Sensitive details such as credentials or vulnerability data should move through encrypted email or a client portal. Plain chat or personal accounts are not acceptable.
Triggers for communication
Some events call for contact at once, beyond the normal schedule.
| Trigger | Why it matters |
|---|---|
| Critical vulnerability found | Client may need to patch before the test ends |
| Sign of a real intruder | May need incident response |
| Test caused an outage or instability | Client must be able to restore service |
| Scope or goal change requested | Needs written approval |
| Fragile system or unexpected asset found | Protects availability |
Escalation paths
An escalation path says who is told first and who is told next if there is no answer. For example, a tester contacts the technical lead, then the project sponsor, then an executive contact.
It also defines the tester's own chain, such as the engagement lead and the account manager. Following the path avoids both silence and panic.
Peer review
Peer review means that a second qualified person checks the work. The reviewer looks at whether findings are accurate and reproducible, severity ratings are fair, and the report is clear.
It also catches mistakes such as testing an out-of-scope address or including sensitive data in the report. Peer review is part of quality control, not a sign of distrust.
Deconfliction and goal reprioritisation
Deconfliction means telling the right client staff which activity belongs to the test so that it is not mistaken for a real attack. It is normally done by sharing source addresses, test windows and tool names with a small trusted group, such as the security operations centre (SOC) manager.
In some red team exercises the defenders are not told, so only a few white team members know. The white team is the neutral group that controls the exercise and can stop it.
Goal reprioritisation happens when early findings change what matters most. The tester and client agree on the new focus, record it and adjust the plan.
Colour teams
| Team | Role |
|---|---|
| Red team | Simulates attackers |
| Blue team | Defends and responds |
| White team | Referees and controls the exercise |
| Purple team | Red and blue work together to improve detection |
Explaining risk to stakeholders
Risk is the combination of how likely something is and how bad the impact would be. Business leaders need that in terms of money, reputation, legal exposure and operations, not in technical jargon.
A severity score such as CVSS (Common Vulnerability Scoring System) is a starting point. The tester adds context, such as whether the system holds sensitive data or is exposed to the internet.
Leaders usually respond to a risk in one of four ways.
- Mitigate it with a fix or control.
- Accept it and document the decision.
- Transfer it, for example through insurance or a contract.
- Avoid it by removing the activity or system.
When a question asks how to describe a finding to executives, choose the answer that states business impact and a recommended action, not the one with exploit details.
What to remember for the exam
- The communication plan lists contacts, emergency numbers, update schedule and secure channels.
- Critical findings, signs of a live intruder and accidental outages are communicated immediately.
- The escalation path says who to contact next when the first contact does not respond.
- Peer review improves accuracy and catches scope or data-handling errors before the client sees them.
- Deconfliction helps the SOC separate authorised test traffic from real threats.
- White team controls the exercise, red team attacks, blue team defends, and purple team combines red and blue.
- Risk is explained as likelihood and impact in business terms.
- The four risk responses are mitigate, accept, transfer and avoid.
Common mistakes
Waiting for the status meeting. Urgent problems follow the escalation path at once, not the calendar.
Using jargon with executives. A list of Common Vulnerabilities and Exposures (CVE) identifiers means little to a board, but a statement about customer data loss does.
Confusing deconfliction with evasion. Deconfliction shares test details with a few trusted people so the work is safe, while evasion is about avoiding detection.
Skipping peer review under time pressure. Errors found by the client damage trust more than a short delay.
Mixing up the colour teams. The red team attacks, and the white team is the neutral referee.
Check yourself
Who is the white team in an exercise?
The neutral group that controls and oversees the exercise and can stop it.
When should a tester contact the client outside the normal schedule?
When there is a critical finding, a sign of a real intruder, or an outage caused by testing.
What are the four common risk responses?
Mitigate, accept, transfer and avoid.
Topic 3 of 5 in Engagement Management
Test yourself on Engagement Management
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.