Description
The penetration test covered the external and internal network, but the identity provider and the customer VPN gateway were only partly in scope. Both systems sit on the path of every customer connection, and the tester suggested testing them in depth next time. Adding them to the scope of the next test costs little and follows directly from the Risk assessment.