Article contents
A penetration test means a security check in which a specialist, with the company's written permission, tries to break into its website, app, network or cloud using the same methods as attackers, to find the weak spots before they do. The result is a report: what the tester managed to do, what it means for the business and what to fix first.
The full name is "penetration testing", often shortened to pentest. NIST, the US standards institute, describes it as mimicking real attacks to find ways around the security of an application, system or network. [1] The UK NCSC compares a pentest to a financial audit: an outside check shows whether your internal security processes really work. [3] What it looks like in practice is described on the penetration testing page.
In short
- A pentest is done by a person, not only a program: they look for what can actually be done with the weak spots.
- Companies order it before a product launch, after big changes, when a partner or customer asks and on a regular basis, usually once a year.
- Stages: agreement and scope, written permission, testing, report, fixes and a retest.
- Without the system owner's written permission the same work becomes unlawful access.
Why companies do a pentest
A company usually does not know how its systems look through an attacker's eyes. Developers check that features work, while a pentester checks that they cannot be made to work the wrong way: can one customer see another's data, can someone log in without a password, is an unneeded service open to the internet.
Typical reasons to order a pentest:
- a launch or big update of a product with customer data or payments;
- a request from a partner, bank, large customer or regulator;
- a check after an incident, to find where else the holes are;
- wanting to know where to spend the security budget first.
If at least one reason fits you, plan the penetration test in advance: preparing access and permission takes time too.
How a pentest differs from a scan and a red team
| Penetration test | Vulnerability scan | Red team | |
|---|---|---|---|
| Main question | What could an attacker actually do? | What is outdated, exposed or misconfigured? | Will the team notice and stop a targeted attack? |
| Who does it | A person, helped by tools | Mostly a program | A team acting like real attackers |
| Depth | Deep, within agreed systems | Wide but shallow | Any path to an agreed goal |
| Who it suits | Most companies with their own product | Everyone, for regular control | Companies with their own security team |
A scan automatically looks for known problems, while a pentest checks whether they can be used. Details in pentest vs vulnerability scan.
A red team means a group that imitates a targeted attack on the whole company to test its defence and response, not to find as many vulnerabilities as possible. [4] There is a comparison in red team vs pentest.
How a pentest works: the stages
NCSC describes a typical pentest as initial engagement, scoping, testing, reporting and follow up. [3] NIST guide SP 800-115 splits the testing itself into planning, discovery, attack and reporting. [2] In plain words:
- Agreement and scope. Together you decide what is tested: which websites, apps, addresses and user roles, and what stays out.
- Written permission and rules. Dates, hours, forbidden actions, contacts in case something breaks.
- Reconnaissance. The pentester gathers information: what is visible from the internet, which technologies are used, how login works.
- Attack. They try to use the weak spots they found and chain several small issues into one serious one. Anything critical is reported at once.
- Report. Findings, their impact on the business and the order of fixes.
- Retest. After the fixes the pentester confirms the problems are closed, if this is agreed in the contract.
Black, grey and white box
These names describe how much the pentester knows about the system at the start.
- Black box. The pentester knows nothing, like an outside attacker. It is realistic, but some problems may stay undiscovered in the time available. [3]
- Grey box. The pentester has ordinary user accounts and a general description of the system. This shows what a customer or partner could do, and it often gives the best balance of depth and time.
- White box. The pentester has documentation and sometimes the code. The check is the deepest, because no time goes into guessing. [3]
What the report gives you
A good report works for both the manager and the developer:
- a short summary in plain language: what was found and what to fix first;
- each finding with steps to reproduce it, so a developer can repeat it;
- a risk rating with an explanation, not just the word "critical";
- specific recommendations on what to change;
- a list of what was not tested, so nobody treats it as safe.
NCSC reminds that a pentest shows the state of a system only on the day of the test. [3] So the report is useful when every finding has an owner and a deadline.
How long it takes and how often
The timeline depends on the scope: the number of systems, roles and features. For a small web application it is usually a week or more, for several systems longer. The exact timeline is fixed before the start, after a conversation about your systems. What makes up the scope and the price is covered in what a pentest includes and what it costs.
How often: usually once a year and after big changes, such as a new product, an integration or a move to the cloud. Between pentests, regular scanning helps.
The legal side: written permission
A pentest is legal only when the system owner has given written permission. Without it the same actions are unlawful interference with computer systems, which is a criminal offence in Ukraine. NIST advises agreeing the rules of the test and the legal questions before the start. [2]
The permission usually states:
- which systems can be tested and from which addresses;
- the dates and hours of active testing;
- what is forbidden, for example overloading a service or deleting data;
- who is on call on your side and how to stop the test.
Third-party services (hosting, cloud, payment provider) belong to other companies and have their own rules. The permission is signed by a person who really has the right to decide for the company. How to choose a provider who explains all this in advance is covered in how to choose a penetration testing company.
Checklist: are you ready for a pentest
Download the preparation checklist (PDF)PDF · A4
FAQ
What is a penetration test in simple terms?
It is a check in which a specialist, with your written permission, tries to break into your website, app or network like an attacker would. The goal is to find weak spots before real attackers do and to get a report with the order of fixes.
How is a pentest different from a vulnerability scan?
A scan automatically looks for known problems across many systems. A pentest is done by a person who checks whether those problems can actually be used to reach other people's data, money or access.
Is a pentest safe for a live system?
There is a risk if there are no rules. That is why forbidden actions, testing hours and a contact in case something breaks are agreed before the start. Some checks can be done on a test copy of the system.
How long does a pentest take?
It depends on the scope. For a small web application usually a week or more, for several systems longer. The exact timeline is fixed before the work starts.
Is penetration testing legal?
Yes, if the system owner has given written permission with the scope and the rules. Without such permission the same actions are unlawful access.
