Pentesting contracts

The key difference between a pentest and a real cyber attack is that a pentest is conducted with the full legal consent of the owner of the computer system that you’re pentesting.

Full legal consent shouldn’t be merely a verbal agreement or a “gentleman’s agreement” signed with a handshake. You absolutely must have written legal documentation signed by both a representative of the computer system’s owner and you. Not having signed legal documentation before a pentest is a recipe for disaster because conducting the actions of a pentester without legal consent often constitutes digital crime in most countries around the world. There can be severe legal repercussions both in a civil court and possibly a criminal court. A signed legal contract is proof of what both parties consented to, whereas verbal agreements and other sorts of informal agreements absolutely will not hold up in court! You want to protect yourself legally...