---
title: Create a new penetration testing assessment request
description: Initiate a penetration test assessment request for your web applications, mobile applications, or APIs. These requests are submitted to the ethical hacking team, who then proceed to test these applications and manually report the penetration test findings.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/create-new-pen-test-assesment-req.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Penetration testing workspace, Use, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Create a new penetration testing assessment request

Initiate a penetration test assessment request for your web applications, mobile applications, or APIs. These requests are submitted to the ethical hacking team, who then proceed to test these applications and manually report the penetration test findings.

## Before you begin

Role required: Application Owner

## Procedure

1.  Navigate to **Penetration Testing Workspace**.

2.  On the **Penetration Testing Assessment Request** form, fill in the fields.

3.  Select **Submit**.

    An email notification is sent to the ethical hacking team that the request has been created for the relevant application.

4.  Once the form is submitted, the ethical hacking team can **Start Scoping**.

5.  Post scoping, the application owner prepares the test environment and the ethical hacking team can **Start testing**.

6.  In case you must verify the details in the request from, you can mark the testing phase on hold by selecting the **Put on hold** button.

7.  Once the testing is complete, you can view the AVITs under the Penetration Testing Test findings tab.

    **Note:** You can duplicate a request from an existing request. Once duplicated, the AVITs attached to the parent request are moved \(not copied\) to the duplicated request.