- A penetration test is a controlled, authorised attack carried out by experts to find weaknesses before criminals do.
- It differs from a vulnerability scan, which is automated and broader but shallower.
- The value comes from a clear scope and a report you can act on.
What a penetration test is
In a penetration test, often called a pen test, security specialists try to break into your systems with your permission, using the same techniques as real attackers. They then report what they found, how they got in, how serious it is and how to fix it. The aim is not to embarrass anyone. It is to learn where you are weak while the attack is still a drill.
Pen test or vulnerability scan?
| Item | Vulnerability scan | Penetration test |
|---|---|---|
| Method | Automated tool checks for known flaws | Skilled people chain weaknesses together, using judgement |
| Depth | Broad and shallow | Narrower and deep |
| Output | A list of findings | A story of how an attacker could succeed, with proof |
| Frequency | Often continuous or monthly | Typically yearly or after major change |
You need both. Scanning, as in vulnerability management, keeps the basics clean every month. Testing checks that your defences hold up against a determined human.
Common types of test
- External network test: what an attacker can reach from the internet.
- Internal network test: what an attacker could do after getting inside, for example through a stolen laptop or phishing.
- Web and application test: flaws in your websites and software. See application security.
- Cloud configuration review: settings and permissions in your cloud accounts.
- Social engineering test: whether staff can be tricked into giving access.
How to scope a test well
- 1Decide what you most need to protect: customer data, payments, a key application.
- 2List the systems in scope and, just as important, anything that is off limits.
- 3Agree the dates and how the testers will contact you if they find something urgent.
- 4Say whether it should be announced to staff or kept quiet, to test your detection.
- 5Ask what is included afterwards: a report, a walkthrough and a free retest of the fixes.
Reading the report
A useful report starts with a summary leaders can understand, then lists each finding with a severity, evidence, the business impact and clear steps to fix it. Prioritise by severity and by how easy the issue is for an attacker to use. Ask for a retest to prove the fixes worked. Our penetration testing service includes a report written for both leaders and engineers.
When to test
- At least once a year for systems that hold customer data.
- Before launching a major new product, application or integration.
- After a significant change to infrastructure or after an incident.
- When a customer, insurer or standard such as ISO 27001 or SOC 2 preparation asks for evidence of testing.
Further reading
Independent sources we recommend for more detail.