Penetration Testing (Pentesting)
An authorized simulated cyberattack on a computer system, performed to evaluate the security of the system.
Detailed Explanation
Unlike automated scanning, a pentest is a manual, creative attempt by a security professional to find and exploit vulnerabilities. It mimics the behavior of a real attacker. The result is a detailed report of how the system was breached and recommendations for hardening it. Pentests are typically performed annually for high-security applications.
Quick Summary
A pentest is a paid, authorized humans-trying-to-break-in exercise. It finds the chained, contextual, business-logic bugs that automated scanners can't, and produces evidence buyers and auditors actually trust.
Key Takeaways
- Scopes: black-box (no info), gray-box (some access), white-box (full code and credentials). Gray-box is the usual sweet spot.
- Methodologies follow OWASP Testing Guide, NIST 800-115, or PTES, your provider should reference one.
- Findings come ranked by severity and exploitability with reproduction steps and recommended fixes.
- Retesting after remediation is standard and worth scheduling upfront in the engagement.
- Pentest reports are critical sales artifacts in B2B SaaS, enterprise customers ask for them.
When to use it
- Annual third-party assessment for SOC2, PCI-DSS, or ISO 27001 evidence.
- Pre-launch testing of a major new feature or product.
- Red-team exercise simulating a sophisticated attacker over weeks, not hours.
- Sales enablement, sharing the executive summary (not the raw report) with prospective customers.
Common Mistakes
- Scoping too narrow ("just this one endpoint") and missing the real attack paths through related services.
- Skipping retest, so the report shows unresolved highs forever.
- Treating findings as opinions rather than actionable bugs; route them through your normal triage and fix process.
- Buying the cheapest pentest available, vendor quality varies dramatically; ask for redacted samples.
Penetration Testing (Pentesting), Frequently Asked
Internal team or external vendor?
Both, ideally. Internal red teams (where you have one) work continuously and know the system deeply. External vendors bring fresh eyes and the independence auditors require. For most companies, external annual + internal continuous is the right mix.
How much does a pentest cost?
Typical web-app engagement runs $15K–$50K for 1–2 weeks of work. Network or red-team engagements run higher. Cheaper offerings usually mean a scanner with a human pasting the results into a Word template, verify the methodology before signing.