---
title: Configure assessment types for penetration testing
description: Configure the estimated effort for each type of penetration testing assessment. This enables you to manage the capacity of each sprint, by estimating the effort required for each assessment type.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/pen-test-config-assessment-types.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Configure penetration testing, Configure, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Configure assessment types for penetration testing

Configure the estimated effort for each type of penetration testing assessment. This enables you to manage the capacity of each sprint, by estimating the effort required for each assessment type.

## Before you begin

Role required: Ethical Hacking

## About this task

Each sprint is assigned to a penetration testing request. Based on the estimated effort for the assessment type, the hours are adjusted to reflect the balance hours for the sprint.

## Procedure

1.  Navigate to **All** > **Application Vulnerability Response** > **Administration** > **Penetration Testing Configuration**.

2.  Starting with v19.0 of Vulnerability Response, select **Configure** to display Assessment types, Application size and Estimated effort.

3.  Select an Assessment type record to update the fields as required or create new records.

    The Application size values provide you with more options to help estimate test time and effort more accurately. You can edit the hours for these records or select **New** to create your own combinations.

    You can modify Assessment type and Application size on values on existing penetration testing request records so that you can schedule tests to match sprint capacity. For example, if you fill out a test request, you might not see the number of sprints you configured, because some sprints are already taken for testing. If a sprint's estimated effort hours match the combination required for a test's type and size, they are not available for new requests.

    You can see the sprints that are assigned to test requests on records on the Penetration Testing Sprints list at **All** > **Application Vulnerability Response** > **Administration** > **Penetration Testing Configuration** > **Configure sprints**. See [Configure sprints for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-sprints.md) for more information on configuring sprints.

    The base values for Assessment type, Application size, and Estimated effort are:

    |Assessment type|Application size|Estimated effort \(hrs\)|
    |---------------|----------------|------------------------|
    |Focused Test|Small|20|
    |Focused Test|Medium|30|
    |Focused Test|Large|40|
    |Focused Test|Standard|40|
    |Re-Test|Small|10|
    |Re-Test|Medium|15|
    |Re-Test|Large|20|
    |Re-Test|Standard|20|
    |Full Penetration Test|Small|60|
    |Full Penetration Test|Medium|70|
    |Full Penetration Test|Large|80|
    |Full Penetration Test|Standard|80|

4.  Select Update to save your changes or Submit for a new record.

5.  Prior to v19.0, select the **Configure** option for Configure assessment types.

6.  Update the values for the assessment types as required.

    Base values are:

    |Assessment type|Estimated effort \(hrs\)|
    |---------------|------------------------|
    |Focused Test|40|
    |Re-Test|20|
    |Full Penetration Test|80|

7.  Save the changes.


**Parent Topic:**[Configure penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-v16-1.md)