Use penetration testing to answer a bounded security question
Core Impact is a penetration-testing product within Fortra's offensive-security portfolio. Its selection should begin with the assessment workflow, operator capability and the evidence the customer needs to obtain. A tool used to validate an exposure is different from a vulnerability scanner that reports candidate weaknesses without the same assessment process.
Identify whether the requirement is a training lab, a controlled evaluation or an authorised engagement. Written scope should state systems, permitted activities, timing and the owner who can stop the work. A product enquiry does not imply permission to test linked services or another organisation's infrastructure.
Plan reporting and retesting before the exercise
Confirm current licensing, supported operating requirements and the operator training needed for the selected use case. Choose a representative non-production evaluation wherever that can establish suitability. Define evidence handling and the method for distinguishing a confirmed finding from a tentative observation.
For a customer engagement, agree reporting, cleanup, remediation ownership and retest criteria before activity begins. The useful deliverable should explain affected systems, business context and what must change, without exposing sensitive evidence unnecessarily. MMC's supply or coordination role should be separate from any specialist assessment services and manufacturer support. Do not promise a particular security outcome from ownership of the software alone; the value depends on authorised operation and practical follow-through.
Evidence to request for this scope
- Confirm operator readiness and a written lab or engagement boundary.
- Agree evidence handling, stop conditions and the customer contact for operational concerns.
- Define the report, remediation handoff and authorised retest before the assessment is scheduled.