Penetration Testing

What is penetration testing?

Penetration testing (pentesting) is a methodical security assessment of IT systems that involves simulating real-world attacks. A penetration tester, equipped with knowledge and tools comparable to those used by adversaries, attempts to bypass an organisation’s defences - finding vulnerabilities, exploiting them and assessing the potential impact.

Penetration tests can cover various areas: web applications, network infrastructure, wireless networks, mobile applications, OT systems and physical security. Depending on the level of knowledge available to the tester, tests are categorised as black-box (no knowledge of the system), gray-box (partial knowledge) or white-box (full access to documentation and source code).

The outcome of a penetration test is a report containing a list of identified vulnerabilities, a description of how they were exploited, a risk assessment and remediation recommendations. A well-conducted test gives the organisation practical knowledge about the state of its defences - not theoretical threats, but confirmed attack paths.

Why does it matter?

Regular penetration tests allow organisations to discover vulnerabilities before attackers exploit them. Many regulations - NIS2, DORA, PCI DSS - require penetration testing at defined intervals or after significant changes to infrastructure.

Penetration tests do not replace other security mechanisms, but complement them. Automated vulnerability scanners detect known flaws, while an experienced tester can chain several seemingly minor vulnerabilities into an effective attack path that a scanner would not identify.

Related topics

• Red teaming
• Vulnerability management
• CVSS