What the Scope? Sh** my Consultant

Luke McOmie and Qasim Ijaz, both veteran offensive security practitioners, open with the frustrations that build up around penetration tests. They describe scopes that exclude most of a network, decisions made by executives or lawyers rather than the staff who run the systems, and requests to switch off endpoint tools before testing. Each complaint is paired with the view from the other side of the table.

The middle of the session collects real stories. One covers a red team that got a payload executed through a print request in an office, and another describes a client whose controls blocked attacks but went unrecognised because testers were told to disable them. The speakers argue for testing with defenses running, for reports that explain how access was gained and how to reproduce it, and for prioritised findings instead of hundreds of scanner results. They also cover MFA that can be bypassed through phishing and one-time code capture, a network outage caused by aging hub hardware during a test, ownership of zero-day discoveries, vague statements of work, and yearly provider changes that erase accumulated knowledge.

The takeaways are to treat the engagement as a partnership, share context and budget early, log WAF and MFA activity to a SIM, and keep a consistent provider with occasional independent checks. The talk is a candid, humorous reminder that testing only helps when both sides communicate.