A pen test is more than just a simple test; it’s a large-scale engagement. Before you begin, you need to explain to your client what the impact of the tests might be. If they have any constraints, such as not attacking a production server, they should make you aware of them since the result could be catastrophic for the business if it went down during one of your attacks.