Definition
Penetration testing (pen testing) is a simulated cyberattack against your computer system, network, or web application to identify exploitable vulnerabilities. Ethical hackers use the same tools and techniques as malicious attackers to find weaknesses before they can be exploited.
People Also Ask
Common questions about Penetration Testing answered by our security experts.
Penetration Testing in Practice
The word covers a wide range of work, and the range is the reason quotes for the same request differ by a factor of four. A test against a single web application with three user roles and a test against a corporate network with forty subnets are both “a penetration test”, and they share almost nothing.
What distinguishes a real test from an expensive scan is the proportion of manual work. Automated tooling finds known vulnerabilities in known software. It cannot find that changing a customer identifier in a request returns another customer's records, because that requires understanding what the identifier means.
The main types, and what each answers
| Type | The question it answers |
|---|---|
| External network | What can an attacker reach from the internet? |
| Internal network | What can someone already inside reach next? |
| Web application | Can a user act outside their own permissions? |
| Wireless | Can someone in the car park reach the corporate network? |
| Social engineering | Will staff hand over access when asked convincingly? |
| Physical | Can someone walk in and plug something in? |
Most organisations need the first three on a rotation, not all six every year. Buying a wide, shallow test across everything consistently produces less value than a deep test of the systems that would actually hurt.
What separates a good report from a bad one
A finding your engineers cannot reproduce is a finding they will argue with and eventually ignore. Ask any prospective vendor for a redacted sample report before discussing price — fifteen minutes with one tells you more than any proposal.
How often, and what should trigger one
Annual testing is a convention, not a standard. The useful trigger is change, not the calendar:
| Trigger | Test |
|---|---|
| A new internet-facing application | Before launch, authenticated |
| A significant architecture change | Scoped to what changed |
| A merger or acquisition | The inherited estate, before connecting it |
| A new compliance obligation | Whatever the obligation names |
| No material change in a year | An annual external test is a reasonable floor |
The pattern worth avoiding is an annual test of a static estate while the application shipping fortnightly goes unexamined. That is testing for the auditor rather than for the risk.
Where the money gets wasted
- Testing annually because the calendar says so, on an estate that has not changed, while a new application ships untested
- Paying a tester to find missing patches your own scanning would have caught — fix those first and buy their time for what scanning cannot see
- No remediation budget. A test with nothing set aside to fix what it finds converts money into a document
- Excluding the interesting systems on safety or availability grounds without recording them as known unknowns
Where to start
Decide what question you want answered before requesting a price. “Can an attacker on the internet reach customer data” and “does our new portal have authorisation flaws” are different engagements with different costs, and no vendor can scope either from a request that just says “penetration test”.
Further reading: what a penetration test costs and what drives the price, how to choose a testing vendor, and scanning versus testing. GuardsArm delivers testing against a written specification — see penetration testing services.
Related Terms
Vulnerability Assessment
A vulnerability assessment is a systematic process of identifying, quantifying, and prioritizing security vulnerabilities in systems, networks, and applications. It uses automated scanning tools and manual analysis to discover weaknesses that could be exploited by attackers.
Red Team
A red team is a group of security professionals who simulate real-world attacks against an organization to test its defenses. Unlike penetration testing, red team exercises assess the entire security posture including people, processes, and technology across an extended engagement.
Compliance
Compliance in cybersecurity refers to the process of meeting established security standards, regulations, and legal requirements. Organizations must adhere to frameworks such as SOC 2, HIPAA, PCI DSS, GDPR, and industry-specific regulations to protect data and avoid penalties.
Related Reading
What a Penetration Test Costs in Canada, and What Drives the Price
Quotes for the same job routinely differ by a factor of four. The variables that actually move the number, and how to make bids comparable.
Choosing a Penetration Testing Vendor: Scope, Evidence and Reporting
The sample report tells you almost everything. What to look for in it, and the scoping discipline that makes bids comparable.
Vulnerability Scanning vs Penetration Testing: Stop Buying the Wrong One
One is a continuous automated process you should already run. The other is a periodic human exercise. Buying either as a substitute for the other…
Speak With an Expert
Book a free consultation to discuss penetration testing for your organization.
Related Services
Need Help With Penetration Testing?
Our certified security professionals can help you implement the right penetration testing strategy for your organization. Get a free assessment today.
Book a Free Consultation