Hack the Planet... Step 1, Step 2, Step

The session opens with CREST, an accreditation body that has been assessing penetration testing providers since 2006, explaining why the term is so loosely understood. Because buyers use terms like vulnerability assessment, ethical hacking and red teaming interchangeably, CREST published an approved penetration test specification that sets minimum expectations for scoping, delivery and sign-off. The speakers stress that the goal is commercial defensibility, and they describe tiers of individual competence, from practitioner through registered to certified, as a way for buyers to judge who they are hiring.

A penetration testing provider then walks through a healthcare client's cloud assurance engagement. The scope was black box and adversarial, so the team started from public infrastructure and mobile apps. A decompiled Android app led to an endpoint whose stack trace exposed a bearer token for a Microsoft Graph API with broad permissions. Validating the token showed access to user lists, files and the ability to send mail as other users. Because this was production, the team informed the client at once, and testing paused while the client remediated. The walkthrough tied each stage to a repeatable process: kickoff, reconnaissance, testing, exploitation, reporting, debriefs and cleanup.

The question-and-answer session covered reporting for non-technical executives, with an executive summary framed in business risk and separate technical detail. Speakers noted that CREST is not a pass or fail audit. Applicants that fall short are coached and can resubmit, individuals are reassessed every three years and organizations yearly. The practical takeaway for buyers is to state clearly whether they want a CREST-accredited test, define their goals and scope up front, and expect consistent, usable reporting.