On a typical penetration test, you will be asked to whitelist the penetration tester and their source IP addresses on any Web Application Firewall (WAF) or Intrusion Prevention System (IPS). This may feel counter intuitive, when you are looking to gain assurance of the security of your system. However, this is a common and practical means of getting the most out of your test. One thing a real attacker has is time. They can very slowly and patiently chip away at your system under the radar over a very long period of time, evading WAFs and IPS. A penetration tester has a fixed amount of time to find as many vulnerabilities as possible. As soon as a penetration tester starts a scan it is likely that they will be blocked, meaning they would have to work very slowly to avoid detection, increasing the time (and cost) needed for the engagement. Whitelisting the WAF/IPS allows the penetration tester to more easily find and highlight as many vulnerabilities as possible, that can then be risk assessed and remediated. The WAF/IPS then provides an additional layer of protection over the top of an assured secure system. There are situations where there may be a requirement to test the efficacy of a WAF / IPS, and there are many techniques that can be used to do this. For example, doing the initial test with WAF/IPS off, to find as many vulnerabilities as possible, then doing an exercise afterwards to see how easily any serious issues could be exploited with the WAF/IPS on. During the scoping exercise, we ensure that we fully understand the requirements, and ensure we recommend the most method of testing suitable type of testing.