A penetration tester identifies an attractive target outside the signed scope. What should happen before testing it?

1. Proceed because Internet exposure implies consent
2. Ask an unrelated employee informally
3. Obtain explicit authorization through the agreed process
4. Hide the test from the client to preserve realism