Configure penetration testing

---
title: Configure penetration testing
description: You can configure the sprint duration and estimated effort for penetration testing assessment types. This provides the scheduling functionality for application owners, helping them determine a tentative time frame for their penetration test assessment requests.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/pen-test-config-v16-1.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Configure, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Configure penetration testing

You can configure the sprint duration and estimated effort for penetration testing assessment types. This provides the scheduling functionality for application owners, helping them determine a tentative time frame for their penetration test assessment requests.

## Before you begin

Role required: Ethical Hacker

## About this task

Configuring the penetration test assessment settings for the ethical hacking team also helps determine the group and point of contact that receives the penetration test assessment request.

If you're using the Veracode Vulnerability Integration, the penetration assessment tests in the Veracode Vulnerability Integration are manual findings from Veracode. They are not linked to any penetration test assessment requests you configure in Application Vulnerability Response. For more information about penetration test assessments from Veracode, see the [Veracode Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/veracode-vuln-integration.md).

## Procedure

1.  Navigate to **All** > **Application Vulnerability Response** > **Administration** > **Penetration Testing Configuration**.

2.  Select Configure for configure assignment group.

3.  On the form, fill in the fields.

    |Field|Description|
    |-----|-----------|
    |Penetration testing team user group|Group to which the penetration test assessment request is assigned.|
    |Default assignee for penetration testing assessment requests|Point of contact for the penetration test assessment request.|

4.  Select **Update**.

5.  Use the second section to configure sprints.

    For details, see [Configure sprints for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-sprints.md).

6.  Use the third section to configure assessment types.

    For details, see [Configure assessment types for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-assessment-types.md).


-   **[Configure sprints for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-sprints.md)**  
Configure the sprint duration and capacity for the ethical hacking team so they can manage the sprint capacity for penetration test assessments.
-   **[Configure assessment types for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-assessment-types.md)**  
Configure the estimated effort for each type of penetration testing assessment. This enables you to manage the capacity of each sprint, by estimating the effort required for each assessment type.

**Parent Topic:**[Configuring Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-configuring.md)