Safety Practices When Testing Production Systems
Most clients prefer testing in production or in an environment that closely mirrors production. That preference is reasonable, but it raises the stakes. The difference between a careful engagement and a disruptive one is usually found in the pre-engagement rules and the day-to-day practices the testers follow.
Key controls
- Pre-engagement interviews to identify shared resources, batch jobs, and third-party systems that could be affected.
- Customized scanner configurations that avoid denial-of-service conditions, unsafe memory corruption checks, and high thread counts.
- Canary testing on non-production hosts that mirror production when available.
- Manual review of the application before any automation is pointed at it.
- Clear rules of engagement that define testing windows, stop conditions, and escalation contacts.
These practices are part of our published methodology. See the full methodology and safety page for more detail.