Skip to content

Scope Leakage Audit

Did the days you quoted
match the days you delivered?

A useful check on recent pentests. Compare quoted and actual effort, separate occasional overruns from recurring patterns, and see the financial impact where the data supports it.

Run a free audit View example report Download CSV template

Example report: 27 fictional engagements. A demonstration, not customer evidence or a benchmark.

01 — The input

A small file. A clear comparison.

  1. Choose recent, comparable engagements. Start with 5–10 if that is all you have. More consistent data supports more useful patterns.
  2. Use anonymous references. Add assessment type, approximate date, quoted total days and actual total days. Keep the effort basis consistent.
  3. Add financials only if comfortable. Price, loaded day cost and explicitly unbilled days are optional.
  4. Review the results together. Look at estimate error, reporting and retest allowances, scope changes, and which comparisons are trustworthy.
Read the ingestion and sanitization guide

02 — The output

What the audit gives you.

  • Quoted-versus-actual effort, with explicit tolerance thresholds.
  • Under-scoped and over-scoped engagement rates.
  • Extra delivery days, separated from confirmed unbilled days.
  • Conditional cost and margin impact, without treating all overruns as lost revenue.
  • Descriptive patterns with sample sizes and limitations.
  • Practical changes to scoping, reporting, retest or pricing assumptions.

You should leave with useful findings even if ScopeMargin is never the right product for your firm.

Before you select a file

We need estimation metadata, not pentest evidence.

Do not include customer confidential information, target URLs or IPs, vulnerabilities, credentials, application secrets, or raw security artifacts. Replace client names with anonymous IDs and generalize sensitive scope descriptions.

The browser audit processes CSVs on your device without uploading or storing their contents. You can use the results without sharing them with ScopeMargin or arranging a call. Downloaded reports remain on your device; choose carefully what you share with colleagues. No audit data is sent to an AI provider.

Download example input rows