In a penetration test, security experts try to break into a company's systems with its express permission. Unlike automated checks, a pentest shows whether several small weaknesses can be combined into a real attack path and what the consequences would be. The result is a report with prioritized findings and recommendations.
How does a penetration test work?
A pentest follows a fixed framework:
- Engagement and scope: Goals, systems, time windows, contact persons, and limits are defined in writing. Without this authorization, the access would not be legally covered.
- Information gathering: The testers determine which systems and services are reachable.
- Analysis and exploitation: Vulnerabilities found are verified in a controlled manner to assess their real impact.
- Report: Findings are documented with risk, evidence, and concrete recommendations.
- Retest: After remediation, it is checked whether the measures are effective.
Depending on how much the testers know in advance, a distinction is made between black-box, grey-box, and white-box tests. In a black-box test, they receive no prior information; in a white-box test, they receive comprehensive insight, for example into configurations or source code.
Typical examples
- External test of systems reachable from the internet, such as web servers, VPN access, and mail servers.
- Internal test that checks, starting from a workstation, how far an attacker would get in the network.
- Test of a web application or customer portal before go-live.
- Review of cloud configurations, for example in Microsoft 365.
- Supplementary social engineering tests, provided they are expressly agreed.
What companies should keep in mind
- Clearly define the goal and scope and authorize them in writing, including the consent of service providers whose systems are affected.
- Look for traceable reports with prioritized, actionable recommendations.
- Plan time and budget for remediation and the retest.
- Repeat pentests at regular intervals and after major changes.
How it differs
A vulnerability scan checks for known vulnerabilities automatically and regularly and is part of vulnerability management. A penetration test, by contrast, is a time-limited, predominantly manual in-depth examination. The two complement each other. A red team engagement goes even further: it simulates a realistic attacker over a longer period in order to also test detection and response, for example by a security operations center.
View security services