One of the Forbes 500 companies has been subjected to a large scale attack. You are one of the shortlisted pen testers that they may hire. During the interview with the CIO, he emphasized that he want

Interviewing all employees to rule out insider threats is a valid activity but is not the first priority and does not address the CIO's incorrect assumption about total risk elimination.

Establishing attribution to suspected attackers is an incident response and forensics activity, not a foundational first step in a penetration testing engagement.

A fundamental principle of information security is that zero risk is unattainable; every system carries residual risk after controls are applied. A professional penetration tester must set accurate expectations with stakeholders by explaining that the engagement will identify and reduce risk to an acceptable threshold, not eliminate it entirely. Misrepresenting this could lead to false confidence and negligent security posture from the client.

Launching Wireshark immediately without a scoping agreement or authorization is premature and could violate legal boundaries before a formal engagement is established.