Direct answer
Use the pre-agreed escalation channel for a potentially serious finding, share the minimum evidence needed for an owner to act, and coordinate any further testing. Do not wait for the final report when the agreed escalation threshold has been met.
Set expectations in advance
Agree which conditions require immediate notification, who receives it and how quickly contacts can respond. A live production credential exposure, for example, can require a different response from a low-confidence alert about a staging system.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Preserve safe evidence
Capture the affected system, time, observation and impact hypothesis without collecting additional unrelated data. Use test fixtures where possible. If real credentials appear, handle them as sensitive and involve the authorized owner; do not use them to expand testing.
Reference: NIST SP 800-61 Rev. 3: Incident Response Recommendations.
Coordinate containment
The service owner decides on emergency mitigation, such as restricting access or rotating a secret, through the incident process. The tester should pause activities that might interfere with recovery and record what was observed before the state changes.
- Use the agreed secure contact method.
- Separate confirmed evidence from unverified impact.
- Agree whether further validation is safe and authorized.
Follow up in the report
Document the escalation time, owner, approved action and retest scope. If the issue was fixed before the final report, preserve the original evidence and report the retest separately. If access to validate was unavailable, explain that limitation.
Assessment limits
An urgent finding can involve incomplete evidence and operational tradeoffs. Escalation does not replace the organization's incident response or authorize additional testing.
Frequently asked questions
Should a critical result wait for the final report?
No, if it meets the engagement's escalation threshold. Notify the agreed contact promptly through the secure channel.
Can the tester use a found credential to explore further?
Only if separately authorized and safe under the rules of engagement; otherwise stop and notify the owner.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.