Project planner

Draft your penetration test scope

The Balhence scope builder helps you draft a penetration test scope: application boundaries, user roles, integrations, and deadlines. Prepare a private draft, review the assumptions, and choose whether to share it. The web and API planner is a starting point for a scoped proposal; other systems need a scoping conversation.

Choose a starting point Open the web & API planner
  • No sign-up to plan
  • Human scope review
  • No secrets requested
Example: a web & API test Planning
TRIGGEREnterprise dealEvidence due
SURFACESWeb + API2 trust boundaries
OUTCOMEVerified evidenceReport + re-test

A useful plan says what needs testing, why it matters, and what the report should cover.

Choose your starting point

What are we working on?

The web and API planner is below. Everything else starts with a conversation. Need several kinds of work? Or not sure where to start? That's fine too.

01Apps and APIs
02Trust model
03Test preparation
04Draft scope brief
Free web & API planner

Plan your web or API test.

Six short steps, no sign-up. We ask for counts and general choices, not private system details. Answers stay in this browser; systems and access can be confirmed later, under an NDA. Working on something else?

Do not enter credentials or secrets. Never put passwords, API keys, session tokens, customer data, private hostnames, or exploit details into a scoping tool.

Step 1 of 6Business outcome

Answers stay on this device
01 / Business outcomeWhy does the test need to happen now?

Start with the reason you're planning a test and when you need the results.

Main reason for testing

Choose the reason that best fits your situation.

02 / Target surfacesWhich parts need testing?

Choose the types of application, then count the separate apps and API groups you want included.

In-scope surfaces

Choose every surface that needs active testing in this engagement.

03 / Trust modelWho uses the application?

Different roles, customer accounts, and sign-in methods each add access rules to check.

Tenant model

Authentication paths

Choose every identity path that should be examined.

04 / Critical workflowsWhich actions matter most?

Think about money, sensitive information, approvals, and actions that would be difficult to undo.

Workflows to focus on

Choose the workflows that deserve manual business-logic testing.

How much workflow testing do you need?

05 / Environment & readinessCan testing start safely?

These details help us plan the start date and keep testing safe.

Test environment

Safety window

Inputs already available

Anything missing will appear in your brief as something to prepare.

06 / Evidence & timingWhat do you need at the end?

Choose the reports and follow-up your team or customer needs.

Required outputs

This produces a draft brief, not a quote. We'll check the systems, access, safety rules, timing, and exclusions with you before proposing the work.

What the web & API planner does

What happens to this draft?

Keep it, download it, or choose to send it with an enquiry. It covers web and API planning only. We still review the final scope with you before any work begins.

01 / COVERAGE

A summary of the work

Apps, APIs, roles, tenants, sign-in methods, integrations, workflows, and environments in one place.

02 / PREPARATION

A list of what's missing

Permission, test accounts, safe data, documentation, contacts, and testing rules still to arrange.

03 / TIMING

An initial estimate

The suggested window is only a guide. Reviewing the actual systems and testing rules may change the timing and terms.

Choose the testing scope your project needs

Read the scoping guide or discuss your draft with us.