Configure assessment types for penetration testing

---
title: Configure assessment types for penetration testing
description: Configure the estimated effort for each type of penetration testing assessment. This enables you to manage the capacity of each sprint, by estimating the effort required for each assessment type.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/pen-test-config-assessment-types.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Configure penetration testing, Configure, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Configure assessment types for penetration testing

Configure the estimated effort for each type of penetration testing assessment. This enables you to manage the capacity of each sprint, by estimating the effort required for each assessment type.

## Before you begin

Role required: Ethical Hacking

## About this task

Each sprint is assigned to a penetration testing request. Based on the estimated effort for the assessment type, the hours are adjusted to reflect the balance hours for the sprint.

## Procedure

1.  Navigate to **All** > **Application Vulnerability Response** > **Administration** > **Penetration Testing Configuration**.

2.  Select **Configure** for Configure effort estimation to display Assessment types, Application size, and Estimated effort \(hrs\).

3.  Select a record to open it from the Assessment type column and update the fields.

    Alternatively, select **New** to create records.

    The Application size values provide you with more options to help estimate test time and effort more accurately. You can edit the hours for these records or select **New** to create your own combinations.

    You can modify Assessment type and Application size values on existing penetration testing request records so that you can schedule tests to match sprint capacity. For example, if you fill out a test request, you might not see the number of sprints you configured, because some sprints are already taken for testing. If a sprint's estimated effort hours match the combination required for a test's type and size, they aren't available for new requests.

    You can see the sprints that are assigned to test requests on records on the Penetration Testing Sprints list at **All** > **Application Vulnerability Response** > **Administration** > **Penetration Testing Configuration** > **Configure sprints**. See [Configure sprints for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-sprints.md) for more information on configuring sprints.

    The base values for Assessment type, Application size, and Estimated effort are listed in the following table:

    |Assessment type|Application size|Estimated effort \(hrs\)|
    |---------------|----------------|------------------------|
    |Focused Test|Small|20|
    |Focused Test|Medium|30|
    |Focused Test|Large|40|
    |Focused Test|Standard|40|
    |Re-Test|Small|10|
    |Re-Test|Medium|15|
    |Re-Test|Large|20|
    |Re-Test|Standard|20|
    |Full Penetration Test|Small|60|
    |Full Penetration Test|Medium|70|
    |Full Penetration Test|Large|80|
    |Full Penetration Test|Standard|80|

4.  Select **Update** to save your changes to an existing record or **Submit** to create a record.

5.  Save the changes.


**Parent Topic:**[Configure penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-v16-1.md)