No, that&#x27;s the next step in an <i>external penetration test</i>, which is not the same thing as a vulnerability assessment.<p>In an external pentest, you get a set of netblocks and rules of engagement, and you get as far as you can. That&#x27;s why it&#x27;s called a &quot;penetration test&quot;.<p>In a vulnerability assessment, you get a target (usually an application), and you find as many flaws in that target as you can.<p>Big annual pentests often have wide-open rules of engagements, where you (as a consultant) win big by, for instance, dumping the CEO&#x27;s mail spool. But those projects also start with several meetings worth of negotiating rules of engagement.<p>Vulnerability assessments virtually never have those rules of engagement!<p>Nobody that I know of runs a bug bounty program on pentest norms. To do so would be grossly irresponsible, because on every network with more than 1000 hosts I&#x27;ve ever tested, ever, RCE behind the firewall is gameover for the whole test: you can get everything.