A web application penetration test is only as good as the authorisation letter and the account matrix behind it. If you send a vendor a URL and a hope, you will get a scan of the login page and a polite invoice. If you send them every role, a staging environment that matches production, and the question you need answered, you will get a report you can act on.
This is the scoping conversation we have with Australian buyers before we quote. Steal it. Use it with us or with someone else. The quality of the SoW matters more than the logo on the cover.
Write the question first
Start with the sentence you want to be true when the test is over. Examples that work: "A customer cannot read another customer's invoices." "The SOC 2 auditor will accept this as independent testing of the application." "We can ship the new payments flow without a known critical." Examples that do not work: "Do a pentest." "Check we are secure." "Cover OWASP." OWASP is a method, not a question.
List roles, not just URLs
UnAuthenticated, user, team admin, tenant admin, staff admin. If a role exists in production, it exists in the test. The most expensive finding we have ever written, several times, was an IDOR that only appeared when you were logged in as a slightly privileged user the last vendor was never given.
Staging that is actually staging
A staging environment that runs last year's build, with fake data and no SSO, will produce a report about last year's build, fake data and no SSO. Either invest a day making staging honest, or test production under a tight window and a no-strike list. There is no third option that is still a pentest of the thing users hit.
Grey-box is the default
Black-box testing is a useful threat model for an internet stranger. It is a poor threat model for a customer, a contractor or a staff member, which is who actually steals data from web apps. Give the tester accounts. Give them architecture notes if you have them. Source code is optional. Credentials are not.
Say who will read the report
Engineers need reproduction. A board needs five pages. An auditor needs control language. A customer needs an attestation after retest. If you do not say which of those four people you are buying for, you will get a document that slightly disappoints all of them. Tell us. We will write to that reader.
When you are ready, send the target or read how we test web applications.