A penetration tester is performing an annual security assessment for a repeat client The tester finds indicators of previous compromise Which of the following would be the most logical steps to…

Rules of engagement and standard pentest methodology require that any discovered evidence of an active or prior compromise be escalated immediately - first to the tester's own management to maintain contractual chain of command, then directly to the client - so the client can activate their incident response plan before further damage or data loss occurs while the threat may still be active.

Contacting the client's CISO directly without first notifying the tester's own manager bypasses the contractual chain of command established in the rules of engagement and may violate the terms of the engagement.

Routing the initial notification through the client's legal department introduces significant delay when a potentially active threat demands immediate containment action.

Deferring documentation of a compromise to the final report is dangerous because an active threat actor may continue causing harm during the remaining test period, and immediate escalation is always required when live indicators of compromise are found.