One of the Forbes 500 companies has been subjected to a large scale attack. You are one of the shortlisted pen testers that they may hire. During the interview with the CIO, he emphasized that he want

Interviewing all employees to find insider threats is a valid activity during an engagement but is not the first priority - correcting the client's fundamental misunderstanding of risk management must come first to define the scope properly.

Attribution is valuable in incident response and threat intelligence but is a later-stage activity and does not address the CIO's flawed premise that all risk can be eliminated.

A fundamental principle of information security risk management is that zero risk is unattainable; every system has residual risk after controls are applied. A responsible pen tester must immediately correct this misconception with the CIO before the engagement begins, establishing realistic goals around risk reduction rather than elimination. Failing to set this expectation early can lead to scope creep, unrealistic deliverables, and damaged professional credibility.

Launching Wireshark to capture network traffic without an established scope, authorization, and rules of engagement violates proper pen testing methodology and could itself be illegal without written permission.