Before a sensitive launch
Assess a portal, API, or critical feature before broad exposure.
What is penetration testing? Method, scope, and report
Penetration testing is an authorized assessment that simulates attack techniques against a defined scope to demonstrate exploitable vulnerabilities. It combines information gathering, technical testing, impact validation, and a remediation report. A pentest provides a targeted point-in-time view; it cannot prove that no vulnerability exists.
In one sentence
A pentest demonstrates, within an authorized scope, how a weakness can become a real impact.
Key points
- Written authorization, scope, testing windows, and stop conditions come before testing.
- The report should separate evidence, impact, likelihood, and verifiable remediation.
- Black-, grey-, and white-box describe tester knowledge, not test quality.
- A retest verifies fixes; a risk should not close on a change statement alone.
Term at a glance
- Penetration testing
- Pentest · penetration test · ethical hacking assessment
- English term
- Penetration testing
- Domain
- IT security
- Category
- Offensive assessment
- Level
- Intermediate to advanced
What does a pentest assess?
Testing may cover an application, API, infrastructure, wireless network, or human scenario according to the engagement. The tester looks for realistic paths: one weakness, a chain of misconfigurations, or a business-logic bypass. Proof is limited to avoid unnecessary harm.
Scope determines value. Domains, addresses, accounts, data, environments, permitted techniques, and emergency contacts must be explicit. Testing a third-party system or leaving scope without permission creates technical and legal exposure.
A pentest is a point-in-time assessment. A code change can introduce a flaw the next day. It complements but does not replace patching, secure configuration, AppSec testing, monitoring, and incident response. Findings need owners, deadlines, and a remediation process.
How does penetration testing work?
- 01
Authorize and scope
Define objectives, assets, exclusions, accounts, data, techniques, windows, contacts, and stop conditions.
- 02
Reconnoitre and test
Map the surface, evaluate controls, and safely seek exploitable combinations.
- 03
Validate impact
Retain minimal reproducible evidence, assess reach, and remove test artifacts.
- 04
Report and retest
Prioritize findings, explain remediation, and confirm that the weakness and close variants are fixed.
Concrete example
During a client portal pentest, a tester finds that a standard account can call a hidden administration route. They read only one authorized demonstration record, capture the request, and stop exploitation. The report links the authorization flaw to its impact, recommends a centralized server control, and includes a retest after remediation.
When should a pentest be used?
After major change
Test new architecture, authentication, integration, or migration that changes the attack surface.
Customer or compliance need
Provide an independent assessment with documented scope, method, findings, and treatment.
Control validation
Test how several defences hold up together against realistic scenarios beyond scanning.
Benefits and limitations
- Concrete evidence of exploitable weaknesses.
- Prioritization informed by scenario and impact.
- Discovery of chains missed by scanners.
- A report useful to technical teams and decision-makers.
- Coverage limited by time and scope.
- Outcome depends on scoping and tester expertise.
- Operating risk must be managed during testing.
- No guarantee the system remains secure after changes.
Business value
A pentest answers a precise question about a surface at a point in time. Value comes from remediation, reduced risk, and lessons fed into development. When comparing proposals, examine method, time, expertise, report depth, and retesting rather than address count alone. The linked service page presents delivery; this page provides selection criteria.
Frequently asked questions
How is a security audit different from a pentest?
An audit may review governance, configuration, evidence, and compliance. A pentest actively attempts to exploit weaknesses within an authorized scope. One engagement can combine them, but objectives and evidence differ.
Should we choose black-, grey-, or white-box testing?
Black-box gives the tester little information, grey-box provides accounts or context, and white-box opens more architecture and code. The choice follows the threat and time; more information often enables deeper coverage.
Can a pentest interrupt service?
There is risk. Scoping, load limits, backups, monitoring, available contacts, and stop rules reduce it. Destructive techniques should be excluded or explicitly authorized in a suitable environment.
Related terms
Sources and references
Need to test an application or infrastructure? We can define a safe scope, execute scenarios, and verify remediation.
Scope a pentest