Penetration testing, also known as pen testing, pentesting or ethical hacking, is a security assessment in which a qualified consultant (with your permission) tries to break into your systems in the way an attacker would. The aim is to find the flaws and vulnerabilities that a malicious actor could exploit, and to show what they could achieve if they did.
Unlike an automated scan, a consultant attempts to exploit what they find, so the result shows real impact rather than a list of possibilities. This guide covers what a test involves, the types of testing, the stages, along with who should perform it, how often to test, and what to look for in a provider.
What is the purpose of penetration testing?
The main reason to commission a penetration test is to find out which weaknesses in your applications, infrastructure and processes an attacker could exploit, before one does. A test shows what an attacker could actually achieve, which is often different from what a list of known vulnerabilities suggests.
Many organisations test because a regulator, auditor or customer asks them to. Testing is also worth doing when nobody has asked, because it is the most direct way to check that your defences work.
Why is penetration testing important?
Penetration testing gives a far more contextual view of an environment than an off-the-shelf vulnerability scan, and shows how effective your security defences are. By finding and fixing weaknesses first, it lowers the risk of a successful attack, supports compliance with industry requirements and helps preserve the confidence of customers and stakeholders.
What usually triggers a penetration test?
Most organisations commission their first test because they've been asked for evidence. These are the most common reasons:
- A compliance requirement. PCI DSS asks for penetration testing directly. ISO 27001 and SOC 2 don't mandate it by name, but auditors commonly ask for testing as evidence. Our guidance on penetration testing for compliance covers what each framework asks for.
- A customer security review. Enterprise buyers and procurement teams commonly ask for evidence of recent, independent testing before they sign. See penetration testing for customer security reviews.
- A launch or major change. A new application, a migration or a new integration changes your exposure, and testing before go-live is cheaper than fixing a problem in production.
- Due diligence. Investors, partners or a board may want assurance before a funding round, partnership or deal.
- After an incident. A test shows whether the attack path has been closed and whether any weaknesses remain.
Is penetration testing the same as vulnerability scanning?
No, penetration testing is considerably more in-depth than vulnerability scanning. Vulnerability scanning is an automation-led process that identifies known vulnerabilities in systems and applications through vulnerability scanner software.
The output of a vulnerability assessment provides a list of potential security issues (such as misconfiguration or missing security updates) and is typically not as deep as the manual exploitation and discovery of vulnerabilities.
Penetration testing goes a step further by actively discovering new vulnerabilities and exploiting these weaknesses to determine the potential impact of a real attack. Both are important components of a sound cyber security strategy, with many pentesting providers supplementing penetration test results with vulnerability scanning to provide a more complete view of the security posture.
What types of penetration testing are there?
Penetration tests are named for what they target. These are the main types we deliver, grouped by what they test.
Applications and APIs
- Web application penetration testing is a practical assessment of a web application's logic, authentication and access controls, and identifying exploitable flaws such as SQL injection, cross-site scripting (XSS) and insecure authentication mechanisms.
- API penetration testing tests the REST, GraphQL and SOAP endpoints behind your applications for broken authorisation, data exposure and abuse. A web application pentest is often coupled with an API penetration test.
- Mobile application security testing covers iOS and Android applications, their local storage, and generally the APIs supporting them.
- Desktop application penetration testing is thick-client testing for privilege escalation, insecure storage and the services the application communicates with.
- AI and LLM application testing tests chatbots, assistants, retrieval systems and agents, and the application and API around them, for weaknesses such as prompt injection, data leakage and tool abuse.
Networks and infrastructure
- External penetration testing shows what an attacker can see and exploit from the internet, across firewalls, gateways, remote access and exposed services.
- Internal penetration testing models a breached laptop or a rogue insider, and finds the path to domain admin. It commonly starts from an assumed breach scenario, as our article on assumed breach penetration testing explains.
- Wi-Fi security assessment assesses the configuration of your wireless networks, such as the protocols, encryption and access controls in use, and whether an attacker can reach internal systems. See also our network penetration testing overview.
- Cloud penetration testing tests what you run in AWS, Azure and Google Cloud, with a review of your cloud configuration against CIS benchmarks.
- Configuration and build review reviews firewalls, Windows and Linux servers and workstations against CIS benchmarks and vendor hardening guidance.
Specialist and ongoing assurance
- Embedded device and IoT testing covers hardware products, from hardware interfaces and firmware to the cloud services behind them.
- OSINT reconnaissance shows the exposed data, credentials and assets that attackers can already find about your organisation.
- Password auditing cracks password hashes offline to show what your users are really setting, and where passwords are weak or reused.
Some assessments test people and premises rather than systems. Social engineering assessments try to manipulate individuals into divulging confidential information or performing actions that compromise security, and physical testing is often performed alongside them, where testers attempt to gain access to buildings or secure areas.
Our red team engagements combine these routes in a single operation, and our article on what a red team engagement involves explains how.
What are the different testing approaches?
There are also several different approaches to penetration testing, including:
- Closed box (also known as black-box penetration testing) is where the tester has no prior knowledge or access to the target system/application. This is often used to simulate an external attack.
- Open box (also known as white-box penetration testing) is where the tester has full knowledge of the target system/application, often including source code and architecture documentation. This is typically used to engage with internal teams and provide a deeper analysis of the security posture.
- Grey box penetration testing is a hybrid approach where the tester has limited knowledge of the target system/application, often simulating an insider threat or a compromised account.
- Red teaming is an advanced form of penetration testing that simulates a full-scale cyberattack, including technical, physical, and social engineering aspects. It is designed to test the organisation's overall security posture and response capabilities.
What are the stages of a penetration test?
A penetration test typically follows a structured process to ensure thorough coverage: scoping and rules of engagement, reconnaissance, manual testing and exploitation, post-exploitation (where applicable), and reporting. The exact phases and the frameworks applied will depend on the type of assessment and the scope agreed at the outset.
For a full breakdown of how each phase works and the standards we test against, see our penetration testing methodology page.
What happens after a penetration test?
Following a penetration test, the testing team will usually provide a detailed report that highlights the vulnerabilities found, the methods used to exploit them, and suggestions for further fixes along with an executive focused summary.
Some penetration tests may also include a retesting phase, where the organisation will remediate the identified vulnerabilities and undergo a spot-check to ensure their remediation efforts were effective.
With Exploitr, we deliver a detailed report of the findings, and we also give you full access to all the results and related information through the Exploitr platform. This lets you track the progress of remediation efforts and make sure that all vulnerabilities are handled on time.
How often should penetration testing be performed?
The general rule of thumb is that penetration tests should be performed at least once a year, and ideally whenever there are changes to the target environment. This could be through updates to web applications, a migration of a firewall, or newly integrated systems and infrastructure.
Many factors, such as the size of the organisation, the type of data it holds, how often an environment changes, and the business's risk appetite can influence the frequency of penetration testing. Our article on why a once-a-year penetration test is not enough covers what changes in a year and when more frequent testing makes sense, and our guide to how often to get a penetration test sets out what PCI DSS and ISO 27001 expect.
Who should perform penetration testing?
Penetration tests should be performed by certified professionals, sometimes known as ethical hackers or "penetration testers". These experts have the knowledge, skills, and tools to safely and effectively simulate attacks.
Many larger organisations will have their own internal pentesting team. Smaller organisations might opt to use a third-party provider for this service. Where regulatory compliance is a concern, there are often requirements for penetration testing to be performed by an independent third-party provider and not an in-house team.
If you're at that stage, our guide to choosing a penetration testing provider covers what accreditations mean and the questions to ask a provider before you sign the agreement. For a side-by-side look at the types of pentest providers, see UK penetration testing companies compared.
At Exploitr, we can collaborate with your internal teams to deliver a smooth and effective testing process, confirm any prior testing results, and expand on existing knowledge.
What certifications should a penetration tester have?
Two things are worth checking: the company's accreditation(s), and the certifications held by the individuals who will do the work.
Company accreditation, such as CREST membership, tells you whether an independent body has reviewed a provider's processes and data handling. Individual certifications tell you about the tester. Our page on CREST penetration testing explains how the two differ and how CREST compares with CHECK and the Cyber Scheme.
Some of the most recognised individual certifications are:
- OSCP (Offensive Security Certified Professional), a well-respected certification that demonstrates practical penetration testing skills.
- OSCE (Offensive Security Certified Expert), an advanced certification that requires a deep understanding of penetration testing techniques and methodologies.
- CREST certifications, including CRT (CREST Registered Tester) and the CCT (CREST Certified Tester) specialisations for infrastructure (CCT INF) and applications (CCT APP).
- Cyber Scheme certifications, including the CSTM (Cyber Scheme Team Member) and the CSTL (Cyber Scheme Team Leader) for infrastructure and for web applications.
What is Penetration Testing as a Service (PTaaS)?
Penetration Testing as a Service (PTaaS) is a more modern approach to delivering pentesting services where penetration tests are offered on a subscription basis. Traditional penetration testing engagements are usually one-off projects, focusing upon a specific target (such as a web application) with a defined scope and timeframe.
PTaaS, on the other hand, provides ongoing access to a vendor's penetration testing services, allowing organisations to continuously assess their security posture and respond to emerging threats.
Usually there will be a more flexible engagement model, where organisations can request tests on-demand or schedule regular assessments. This approach allows for more frequent testing and can result in faster response times to remediating vulnerabilities.
A benefit of this for organisations is a predictable business cost, as they can budget for a fixed monthly fee rather than paying for individual tests. Businesses also benefit from the continuous nature of Penetration Testing as a Service by integrating it into their development lifecycle and security operations, allowing for more proactive security measures.
For details on how we structure our Penetration Testing as a Service offering, including pricing tiers and what is covered at each level, see our PTaaS service page.
Frequently asked questions
Is penetration testing legal?
Yes, when it is authorised. Testing systems without the owner's written permission can be a criminal offence, so every engagement starts with written authorisation and agreed rules of engagement that set out what may be tested and how.
At Exploitr we perform our own due diligence and provide a rules of engagement document, which authorised the assessment.
Will a penetration test disrupt our services?
Testing is designed to safely simulate real attacks without causing outages. We agree testing windows and excluded systems in advance, and can test outside peak hours if you prefer. There is an inherent element of risk in any penetration test, so we ask about legacy, sensitive or business-critical services during scoping so that extra care is taken where needed.
How long does a penetration test take?
It depends on the service and the size of the scope. Testing can take from one or two days for a small website to a week or more for a large internal network or SaaS platform. Our service pages give typical durations for each.
How much does a penetration test cost?
It depends on what you are testing and how much depth it needs. The size of the scope, the number of user roles, the complexity of the application and any compliance requirements are the main drivers.
Our penetration testing pricing guide explains what drives cost for each service, and the cost calculator gives an indicative figure for your own scope.
What do I receive at the end of a penetration test?
A report with an executive summary and technical findings, including evidence, severity ratings and remediation guidance, followed by a debrief. At Exploitr every engagement also includes an attestation letter and access to the Exploitr platform to track remediation.
