Every situation is potentially different, and there can be reasons to do either of these options. Testing on a live environment is very common, and very rarely causes any issues. It is probably the most common approach to penetration testing. Some organizations may be wary of exposing their live application, and there are a number of methods that can be taken in this case. This includes replicating the live environment in a test environment to carry out the testing, but then verifying the issues on the live site. Also, specific tests could be carried out on either the live or test environment, e.g., application testing on test, and network testing on the live supporting network. During the scoping process, Dionach can explore the best option that fits in with your environment.