You have just been hired to perform a pen test on an organization that has been subjected to a large-scale attack. The CIO is concerned with mitigating threats and vulnerabilities to totally eliminate

Establishing attribution to attackers is a forensic and threat intelligence task that falls outside the standard scope and first steps of a penetration test engagement.

Interviewing all employees to rule out insider threats is neither practical as a first step nor typically within the defined scope of a pen test engagement.

Risk can never be reduced to zero because new threats and vulnerabilities constantly emerge, and the cost of mitigating every conceivable risk is prohibitive. As a pen tester, setting accurate expectations with the CIO is a critical first step to establish scope and realistic goals for the engagement. Informing the CIO that the work will reduce risk to an acceptable residual level aligns with core principles in frameworks like NIST RMF, which formally recognizes that some residual risk always remains.

Launching Wireshark to capture traffic before defining scope, rules of engagement, and obtaining written authorization would be premature and potentially constitute unauthorized interception.