Security testing for teams that have been putting it off

You know you should be doing security testing. Here's what the first engagement actually looks like, from a team that runs them.