An organization regularly conducts its own penetration tests. Which of the following scenarios MUST be covered for the test to be effective?

Third-party vendors with system access represent a mandatory coverage area in penetration testing because they introduce supply chain risk and trusted-access vectors that bypass perimeter defenses. Vendor accounts often have elevated or persistent access, making them high-value targets for attackers. Failing to test this scenario leaves a significant blind spot in the organization's security posture, as vendor compromise is a common real-world attack vector (e.g., SolarWinds-style supply chain attacks).

While testing compromised administrator access is valuable, it is not the single scenario that MUST be covered above all others, as admin compromise is typically included within broader internal threat modeling rather than being uniquely essential to penetration test effectiveness.

Testing an internal attacker with system access (insider threat) is a useful scenario but is generally considered a subset of standard penetration testing scope; it does not uniquely define test effectiveness compared to the third-party vendor risk vector.

An internal user accidentally accessing data describes an unintentional misconfiguration or access control issue, which is more relevant to access control audits or data loss prevention reviews than to penetration testing, which focuses on deliberate exploitation of vulnerabilities.