An organization has requested that a penetration test be performed to determine if it is possible for an attacker to gain a foothold on the organization's server segment During the assessment, the…

A penetration tester's primary objective is to emulate a real-world attacker and demonstrate the full scope of achievable impact. Using tools already present on a system reflects authentic attacker tradecraft - a real adversary would exploit those resources - and helps the organization understand the compounded risk created by both the prior compromise and the current exposure.

Documenting without leveraging the tools fails to demonstrate the actual exploitation potential those tools represent, leaving the organization with an incomplete picture of their exposure.

Removing attacker tools is outside the penetration tester's authorized scope and could destroy forensic evidence needed to investigate the prior incident.

Halting the engagement is an overly conservative response; discovering prior attacker artifacts is a notable finding but does not invalidate or invalidate an active authorized test unless the rules of engagement specifically require it.