Term · Security & infrastructure
Penetration testing
Penetration testing ("pentesting") is an authorised, simulated attack on a website, application, network or organisation, performed by security specialists to find vulnerabilities that a real attacker could exploit — and to show what they could achieve by exploiting them.
[ 01 ]
Explained
Pentest vs security audit
- A security audit reviews configuration, code, processes and access with full information, and produces a prioritised list of weaknesses.
- A penetration test actively tries to break in, often with limited prior knowledge, and demonstrates real exploitation paths.
For most businesses, an audit and fixes come first; a pentest then verifies the result. See security audit.
Types
- Black box: testers start with no internal knowledge, like an outside attacker.
- Grey box: some knowledge or user-level access, like a customer or partner.
- White box: full access to code and documentation, for the deepest coverage.
- Scope: web application, API, mobile app, internal network, cloud configuration, social engineering.
When it is needed
- Systems handling payments, health, financial or other sensitive data.
- Before major launches of such systems.
- When clients, partners, banks or regulators require it.
- Periodically, and after significant changes.
Doing it properly
- Written authorisation and agreed scope.
- Testing windows and contacts in case something breaks.
- Test environments where production testing is risky.
- A report with findings, severity, evidence and remediation advice, followed by a retest.
[ 02 ]
FAQ
Frequently asked questions
Can a pentest break our site?
There is some risk; experienced testers minimise it, and scope and timing are agreed in advance.
How often should we test?
Commonly yearly and after major changes, more often for high-risk systems.