Penetration testing states

---
title: Penetration testing states
description: Application owners can request penetration test assessment for their applications, and monitor the progress of the ethical hacking team until the request is resolved.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/application-vulnerability-response/pen\_test\_state\_avm.html
release: brazil
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Reference, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Penetration testing states

Application owners can request penetration test assessment for their applications, and monitor the progress of the ethical hacking team until the request is resolved.

The penetration test assessment request passes through the following transition states until it is resolved.

<table id="table_lc4_dsk_qqb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td class="sub-head" colspan="2">

Penetration testing states

</td></tr><tr><td>

Open

</td><td>

State when the assessment request is created by the application owner.

</td></tr><tr><td>

Scoping

</td><td>

Ethical hacking team assesses the request and the scope of the application.

</td></tr><tr><td>

Environment Preparation

</td><td>

Application owner creates an environment with roles and other information and provides it to the ethical hacking team for testing.

</td></tr><tr><td>

Testing

</td><td>

Ethical hacking team manually tests the application to identify the penetration test findings.

</td></tr><tr><td>

V16.1: Testing In Progress

</td><td>

Ethical hacking team indicates that testing is currently in progress. If this state is selected, the **Testing On Hold** option becomes available on the form.

</td></tr><tr><td>

V16.1: Testing On Hold

</td><td>

This field is displayed only when the Testing In Progress state is selected. Ethical hacking team controls the service level agreements \(SLAs\) of the penetration test assessment requests by selecting this state, if required. This ensures accurate SLAs are reported.

</td></tr><tr><td>

V16.1: Testing In Review

</td><td>

Ethical hacking team indicates that testing is complete, and is being reviewed by a subject matter expert.

</td></tr><tr><td>

Closed

</td><td>

The ethical hacking team closes the penetration test assessment requests after the penetration test findings are reported.**Note:** Starting from V16.1, you can use the **Copy and Create Request** option on the form to replicate the request in Closed state and create a new request. For details, see [Replicate a penetration test request in closed state](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/application-vulnerability-response/pen-test-copy-create-request.md).

</td></tr><tr><td>

V16.1: Cancelled

</td><td>

Application owner cancels the penetration test assessment request.

</td></tr><tr><td>

V16.1: Draft

</td><td>

Application owner creates a request and saves it as a draft before submitting the request.

</td></tr><tr><td class="sub-head" colspan="2">

Application Vulnerable Item states

</td></tr><tr><td>

Open

</td><td>

When the ethical hacking team identifies and creates the penetration test findings, their status is Open.

</td></tr><tr><td>

Resolved

</td><td>

When the application team resolves the penetration test findings, their status is moved to Resolved.**Note:** If the penetration test finding has been resolved but is yet to be validated by the ethical hacking team, the substate is **Validation Pending**.

</td></tr><tr><td>

Closed

</td><td>

Ethical hacking team validates that the penetration test findings have been resolved and moves the status to Closed.

</td></tr></tbody>
</table>