Penetration testing, commonly called pentesting, is an authorised security assessment in which trained testers simulate aspects of real-world attacks against specified systems, applications, networks, devices, or environments to identify weaknesses and determine what an attacker could actually accomplish. The defining characteristic is authorisation within a clearly agreed scope.
A penetration test is not simply an attempt to break into something; it is a controlled assessment conducted under rules designed to protect the organisation and its systems while generating useful security evidence. Testers may examine external infrastructure, internal networks, web applications, mobile applications, APIs, cloud environments, wireless networks, or particular business processes. The exact methodology depends on the target, objectives, permissions, safety requirements, and rules of engagement established before testing begins.
A penetration test commonly proceeds through stages such as planning, reconnaissance, enumeration, vulnerability analysis, controlled exploitation, post-exploitation analysis, evidence collection, and reporting, although methodologies vary. During reconnaissance, testers gather information about authorised targets and their exposed services. Enumeration identifies details about applications, accounts, protocols, endpoints, and other accessible components. Vulnerability analysis examines weaknesses that could provide a path into the target. Exploitation tests whether selected weaknesses can actually be used under the agreed conditions.
Post-exploitation analysis may determine the practical significance of obtained access, such as whether privileges can be increased or whether access to additional authorised resources is possible. Testers normally stop short of unnecessary destructive actions and avoid collecting or altering sensitive information beyond what the engagement requires.
Scope and rules of engagement are central to safe penetration testing. A client and testing team should establish which systems may be tested, which techniques are permitted, testing windows, source addresses, accounts, communication procedures, emergency contacts, prohibited actions, data-handling requirements, and conditions for stopping the test. Scope can be external, internal, application-specific, cloud-specific, wireless, physical, or a combination. Third-party services create additional considerations because the organisation commissioning the test may not own all infrastructure involved in an attack path. Testing an external provider without appropriate authorisation can create legal and operational problems even when the ultimate target belongs to the client. Proper authorisation therefore distinguishes legitimate penetration testing from unauthorised intrusion.
Penetration testing can be performed using different approaches. Black-box testing gives testers limited information and attempts to approximate an outsider's perspective. White-box testing provides substantial information, such as architecture diagrams, source code, credentials, or application documentation, enabling deeper analysis. Grey-box testing provides an intermediate level of knowledge and can represent situations such as an authenticated user or partially informed attacker. Tests may also be knowledge-based rather than strictly defined by these categories. A web application test might examine authentication, authorisation, session management, input handling, business logic, API security, file handling, and access controls. An internal infrastructure test might examine segmentation, identity systems, privilege escalation, endpoint controls, and lateral movement within the authorised environment.
Penetration testing differs from vulnerability scanning because it seeks to establish practical attackability and impact rather than merely detecting potential weaknesses. A vulnerability scanner might identify an outdated component associated with a known vulnerability, whereas a tester may investigate whether that vulnerability is exploitable in the particular configuration and whether it provides meaningful access. Penetration testing also differs from a generic security audit.
An audit generally evaluates whether controls, policies, configurations, or processes meet defined requirements, whereas penetration testing uses adversarial techniques to test security boundaries. Red teaming is related but typically broader, often involving longer-running adversary simulation against people, processes, physical environments, and technology with objectives reflecting a realistic threat scenario.
The output of a penetration test normally includes a technical report and an executive-level summary. Technical findings describe vulnerabilities, affected systems, evidence, attack paths, impact, severity or risk considerations, and remediation recommendations. Evidence may include screenshots, request and response data, logs, or carefully controlled demonstrations. Good reports distinguish confirmed vulnerabilities from hypotheses and explain the conditions required for exploitation. Findings can reveal chains in which individually moderate weaknesses combine into a serious attack path. For example, exposed credentials might enable initial access, excessive privileges might enable escalation, and inadequate network segmentation might permit access to another critical system. Such chains can be more informative than considering each weakness independently.
Penetration testing has limitations. It represents a finite test conducted during a particular period against a defined scope, so it cannot establish that all vulnerabilities have been discovered or that an organisation is permanently secure. Testers can miss weaknesses, new vulnerabilities can appear after testing, and some security conditions depend on events or configurations that are not present during the engagement. Testing can also create operational risks if intrusive techniques affect fragile systems. Consequently, organisations should treat penetration testing as one component of a broader security programme that includes secure development, vulnerability management, monitoring, configuration management, incident response, access control, and continuous security testing.
The value of penetration testing comes from connecting technical weaknesses to realistic consequences under controlled conditions. It can validate whether security controls actually prevent defined attack paths, expose weaknesses that automated scanners cannot understand, test detection and response capabilities, and help organisations prioritise remediation based on demonstrated impact. Effective testing requires competent testers, explicit authorisation, appropriate scope, careful handling of evidence, and clear reporting. Retesting after remediation can determine whether reported weaknesses have been corrected. Penetration testing is therefore an assessment technique, not a permanent security control: its findings provide evidence about the security of the tested environment at the time and under the conditions of the engagement.
