Penetration Testing Methodology: How a Professional Test Works

A credible penetration testing methodology is what separates a genuine security assessment from an automated scan dressed up as one. When you commission a test, the methodology defines how scope is agreed, how findings are proven, how risk is rated and how results are handed back so your team can act on them. This guide walks through how a professional penetration test actually works, stage by stage, and the UK frameworks that underpin it.

What a penetration testing methodology actually is

A penetration testing methodology is a documented, repeatable approach to assessing the security of a system by simulating the actions of a realistic attacker. Rather than running a tool and exporting a list of alerts, a tester follows defined phases, validates each weakness manually, and records the evidence and steps required to reproduce every finding. The point of a methodology is consistency: two testers working to the same framework on the same target should reach broadly the same conclusions.

In the UK, the most widely recognised reference points are CREST, the OWASP Testing Guide for web and mobile applications, the Penetration Testing Execution Standard (PTES), and NIST Special Publication 800-115. These do not all say the same thing, and a competent provider blends them to fit the asset under test. A web application assessment leans on OWASP; an internal network test leans on PTES and NIST; a CREST-accredited provider wraps the whole engagement in documented quality controls that an external body has audited.

The six stages of a professional penetration test

Almost every serious methodology can be reduced to six stages. The labels vary between frameworks, but the logical flow is consistent.

1. Scoping and pre-engagement. Before any testing starts, the tester and client agree exactly what is in scope, which IP ranges, domains, applications or accounts are covered, what is explicitly out of bounds, the testing window, rules of engagement, and emergency contacts. This stage also sets the perspective: black box (no prior knowledge), grey box (limited credentials or documentation), or white box (full access to source and architecture). Good scoping is what keeps a test safe and legally clean.

2. Reconnaissance and information gathering. The tester builds a picture of the target using passive sources (public DNS records, certificate transparency logs, exposed metadata) and active enumeration (port scanning, service fingerprinting, directory discovery). The goal is to map the real attack surface, which is often larger than the client expects.

3. Threat modelling and vulnerability analysis. Findings from reconnaissance are mapped to likely attack paths. The tester identifies candidate weaknesses, missing patches, weak configurations, injection points, broken access controls, and prioritises them by exploitability and business impact rather than by raw scanner severity.

4. Exploitation. This is the stage most people picture. The tester attempts to safely confirm that a weakness is genuinely exploitable, for example by extracting a record through an injection flaw or escalating from a low-privilege account. Crucially, exploitation is controlled and evidence-led; a professional proves impact without causing damage or disruption.

5. Post-exploitation and lateral movement. Once a foothold exists, the tester assesses how far an attacker could go: what data is reachable, whether privileges can be escalated, and whether one compromised host opens the wider network. This stage demonstrates real business risk rather than a theoretical flaw.

6. Reporting and retest. Every finding is written up with a clear description, evidence, a risk rating, and practical remediation guidance. A strong report is readable by both engineers and the board. A reputable provider then offers a retest to confirm that fixes have actually closed the issue.

Black box, grey box and white box testing

The amount of information a tester is given shapes both the methodology and the value of the result. In a black box test, the tester starts with nothing more than a target name, simulating an external attacker with no inside knowledge. This is realistic but slower, because time is spent on reconnaissance that an insider would not need.

Grey box testing provides limited information, typically a standard user account or basic architecture notes. This is the most common choice for web applications and internal networks because it reflects a realistic threat: an attacker who has phished a single user or a malicious insider. White box testing hands over full documentation, source code and credentials, which gives the deepest coverage per day and is well suited to complex applications or security-critical systems. Many UK organisations combine perspectives, using a grey box approach for breadth and white box review for the highest-risk components.

Which frameworks underpin a credible methodology

A methodology is only as trustworthy as the standards behind it. Four are worth knowing.

CREST accredits the provider and its processes, not just individual testers. A CREST-accredited firm has had its methodology, reporting quality and data handling audited by an independent body, which is increasingly expected by UK procurement, financial services and regulated clients. OWASP publishes the de facto checklists for web and mobile application testing, including the Testing Guide and the Application Security Verification Standard. PTES defines the end-to-end execution flow that the six stages above are drawn from. NIST SP 800-115 is the technical guide many UK public sector and supply-chain contracts reference for security testing.

For organisations pursuing UK certifications, methodology also intersects with compliance. Cyber Essentials Plus requires an assessor-led technical verification, while ISO 27001 expects regular technical testing as part of Annex A controls. A provider that holds CE, CE Plus and ISO 27001 itself understands these obligations from the inside, not just in theory.

What you should receive at the end

The methodology determines the quality of your deliverables. At minimum, a professional engagement should produce an executive summary written for non-technical stakeholders, a detailed technical findings section with severity ratings and reproduction steps, evidence for each issue, and prioritised remediation guidance. Many clients also need a CREST-signed letter or summary for auditors, insurers or prospects.

The risk ratings should reflect genuine business impact, not just a copied scanner score. A finding that exposes customer data on an internet-facing service is a different matter from the same technical flaw buried behind several layers of authentication. A methodology that treats them identically is not doing its job. Where remediation has cost implications, scope complexity and tester days drive the budget; you can see how that maps to UK pricing on our guide to penetration testing cost in the UK.

How EJN Labs approaches penetration testing methodology

EJN Labs is a CREST-accredited UK penetration testing provider, and our methodology is built around the six stages described here, aligned to CREST, OWASP, PTES and NIST SP 800-115. Every engagement is delivered by senior and principal testers, never junior associates, so findings are validated by hand and risk ratings reflect real-world exploitability rather than raw scanner output.

We are also certified to Cyber Essentials, Cyber Essentials Plus, ISO 27001 and ISO 9001, which means our own controls and documented processes have been independently audited, the same scrutiny we apply to client systems. Pricing is fixed and scope-led rather than open-ended, and a free retest is included so you can prove that remediation has closed each finding. You can explore the full range of assessments on our penetration testing services page.

Frequently Asked Questions

What is the difference between a penetration testing methodology and a vulnerability scan?

A vulnerability scan is an automated check that lists potential weaknesses, often with false positives and no proof of impact. A penetration testing methodology adds human analysis: a tester manually validates each issue, demonstrates how far an attacker could get, and rates findings by genuine business risk. The methodology is the structured process that turns raw scanner output into trustworthy, actionable results.

How long does a penetration test take?

Duration depends on scope complexity, measured in tester days. A focused web application or external network test commonly runs from a few days to a couple of weeks, while large or segmented environments take longer. Because every test is delivered by senior and principal testers, the day count, not seniority tiers, drives both timeline and cost.

Which penetration testing framework is best for UK businesses?

There is no single best framework; a competent provider blends them by asset type. OWASP suits web and mobile applications, PTES and NIST SP 800-115 suit network testing, and CREST accreditation provides the independently audited quality layer that UK procurement and regulated clients increasingly expect across the whole engagement.

Should I choose black box, grey box or white box testing?

Grey box testing, where the tester is given a standard user account, is the most common and cost-effective choice because it reflects a realistic attacker who has compromised one user. Black box suits external attack simulation, and white box gives the deepest coverage for security-critical applications. Many organisations combine perspectives for breadth and depth.

Does a good methodology include a retest?

Yes. A credible methodology treats reporting as the start of remediation, not the end of the engagement. A reputable provider offers a retest to verify that fixes have genuinely closed each finding. At EJN Labs a free retest is included as standard, so you receive evidence that risks have been resolved.

Get a CREST-accredited penetration test

If you want a test built on a proven, framework-aligned methodology and delivered by senior testers, we can help. Request a tailored, fixed-price proposal through our CREST penetration testing quote form, or browse the full range of assessments on our services page to find the right starting point.