Cyber Security: What is Pentesting?

Penetration testing (often shortened to pen testing) is an authorised security assessment that simulates the actions of a real attacker against a defined target. The goal is to discover and exploit weaknesses in a controlled way so they can be fixed before a malicious actor finds the same flaws.

Why penetration testing exists

Modern systems are too complex for any individual or team to reason about exhaustively. Vulnerability scanners catch known issues with signatures, but they cannot reason about how findings combine, how access can be chained, or whether a flaw matters in the business context. Penetration testing fills that gap: a skilled tester thinks the way an attacker thinks and demonstrates the impact of weaknesses in real terms.

Standard phases

Scoping defines the target, the rules of engagement, the schedule, and the deliverables.

Reconnaissance gathers public information and maps the attack surface.

Vulnerability identification combines automated scanning with manual review to surface candidate issues.

Exploitation validates findings by demonstrating real-world impact.

Post-exploitation explores how far an attacker could pivot, what data could be reached, and what damage could be done.

Reporting documents findings with reproduction steps, evidence, severity ratings, and remediation guidance.

Retest verifies that fixes have been applied correctly.

Types of engagement

External, internal, web application, mobile application, API, cloud, wireless, social engineering, physical, and red team. Each focuses on a specific attack surface or scenario.

How it differs from a vulnerability assessment

A vulnerability assessment lists weaknesses; a penetration test demonstrates which weaknesses can be exploited and what they mean for the business. Both are valuable: vulnerability assessment for ongoing hygiene, penetration testing for higher assurance and for the deeper findings that automated tooling cannot reach.

UK context

Regulated industries (financial services, healthcare via NHS DSPT, government via NCSC CHECK) expect penetration testing as part of their compliance posture. CREST membership is widely required as evidence of competent testing practice. The Computer Misuse Act 1990 defines the legal boundary: authorisation in writing makes the work lawful.

Related terms

See also: penetration tester, vulnerability assessment, external penetration testing, and web application penetration testing.