What Is Penetration Testing? Types, Process And When You Need One
David Roberts
Founder & CEO - ReVerb
10.21.2026
Penetration testing is an authorized, simulated attack on your systems, carried out by security professionals who try to find and exploit weaknesses before a real attacker does. A penetration test goes further than an automated scan: testers chain vulnerabilities together, prove what an attacker could actually reach, and hand you a report with evidence and fixes. Most organizations need one at least once a year, after major changes, and whenever a framework such as PCI DSS or a customer contract demands it.
This guide answers what is penetration testing in practical terms: the types of penetration testing you can buy, how black box, grey box and white box engagements differ, what happens during a test, which methodologies reputable testers follow, and how to choose a provider.
What Is Penetration Testing?
Pen testing is a time-boxed security assessment in which a tester, working under a written agreement, uses the same techniques as real attackers against a defined scope. That scope might be an external network range, a customer-facing web application, a mobile app, a cloud tenant, an office building, or your staff.
The goal is not to list every theoretical flaw. It is to answer a sharper question: if someone wanted to break in, how far could they get, and what would it take to stop them? A good test produces three things: confirmed, exploitable findings ranked by business risk; the evidence behind each one; and remediation guidance your engineers can act on.
Penetration testing is sometimes called ethical hacking. The difference from criminal hacking is authorization. Every legitimate engagement starts with signed permission, an agreed scope and rules about what the testers can and cannot do.
Penetration Testing Vs Vulnerability Scanning
Buyers often confuse the two. A vulnerability scan is an automated check that compares your systems against a database of known issues, such as missing patches, outdated software and common misconfigurations. It is fast, cheap and should run frequently. It also produces false positives and cannot tell you whether three low-severity issues add up to a full compromise.
A penetration test is led by people. Testers validate what the scanner found, look for flaws scanners miss (broken access control, business logic errors, weak authentication flows), and attempt to exploit them in a controlled way. Scanning tells you where the doors might be unlocked. A pen test tells you which ones open and what is behind them.
Most mature programs use both: continuous scanning between tests, and periodic manual testing for depth. Our full comparison of vulnerability scanning vs penetration testing covers when each one is the right call.
Types Of Penetration Testing
The types of penetration testing are defined by what is in scope. Most organizations start with network and web application tests, then add others as their attack surface grows. Here is what each one covers.
External Network Penetration Testing
An external test targets everything reachable from the internet: firewalls, VPN gateways, remote access portals, mail servers, exposed services and forgotten hosts. Testers usually begin with reconnaissance to map your real external footprint, which is often larger than the asset inventory suggests. This is the test that most closely mirrors an opportunistic attacker.
Internal Network Penetration Testing
An internal test assumes the attacker is already inside, through a phished laptop, a malicious insider or a compromised vendor account. Testers work from a foothold on your network and try to escalate privileges, move laterally and reach sensitive systems. In Windows environments that usually means attacking Active Directory. See internal vs external penetration testing for how to split budget between the two, and our ranking of network penetration testing companies for providers.
Web Application Penetration Testing
Web app tests focus on the application layer: authentication, session handling, access control, input validation, file uploads and business logic. Testers commonly map their work to the OWASP Top 10 and the OWASP Web Security Testing Guide. Authenticated testing, where the tester has user accounts at different privilege levels, finds far more than testing from the login page alone. Compare providers in our list of web application penetration testing companies.
API Penetration Testing
Modern products expose most of their functionality through REST or GraphQL APIs, and APIs often fail differently from web front ends. Common findings include broken object-level authorization (one user reading another’s records by changing an ID), excessive data exposure and missing rate limits. API testing can run alongside a web app test or on its own. Many of the firms in our application security companies roundup cover both.
Mobile Application Penetration Testing
Mobile tests examine iOS and Android apps on the device and the backend services they call. Testers look at insecure local storage, weak certificate validation, hardcoded secrets, reverse engineering exposure and how the app handles authentication tokens. The OWASP Mobile Application Security Testing Guide (MASTG) and verification standard (MASVS) are the usual reference points. See our list of mobile application security companies.
Cloud Penetration Testing
Cloud tests assess your AWS, Azure or Google Cloud configuration: identity and access management, storage permissions, network exposure, secrets handling and paths for privilege escalation between services. Because you share responsibility with the provider, testers stay within what you own and follow each provider’s published testing policy. Misconfigured identity permissions are the most common route to serious cloud findings.
Wireless And IoT Penetration Testing
Wireless tests check Wi-Fi encryption, guest network isolation, rogue access points and whether an attacker in the parking lot can reach internal systems. IoT and embedded testing goes further into firmware, hardware debug interfaces and device-to-cloud communication. Specialists are listed in our rankings of wireless and IoT security testing companies and embedded device security auditors.
Physical Penetration Testing
Physical tests probe whether someone can walk into your building, data center or branch office. Testers may try tailgating, badge cloning, lock bypass or simply looking like they belong, then see what they can plug into or carry out. These engagements need especially careful authorization letters, because testers can be stopped by staff or police. Browse physical security penetration testing firms.
Social Engineering Testing
Social engineering tests measure how people respond to manipulation: phishing emails, phone pretexting (vishing), SMS lures and in-person approaches. The output should be about process gaps, such as a help desk that resets passwords without proper verification, rather than naming and shaming individuals. Compare social engineering testing providers.
Red Teaming
Red teaming is the broadest form of adversarial testing. Instead of finding as many vulnerabilities as possible in a fixed scope, a red team pursues a specific objective (for example, reaching the payments system) using any agreed combination of network, application, physical and social techniques, while trying to avoid detection. It tests your detection and response as much as your defenses, so it suits organizations that already run regular pen tests. Read red teaming vs penetration testing and our list of red teaming companies.
Types Of Penetration Testing At A Glance
Test Type
What It Targets
Typical Trigger
External network
Internet-facing hosts and services
Annual baseline, compliance, new perimeter
Internal network
Active Directory, lateral movement, internal systems
Annual baseline, ransomware readiness
Web application
Authentication, access control, business logic
New release, customer security reviews
API
Authorization, data exposure, rate limits
New or changed APIs, partner integrations
Mobile
App binary, local storage, backend calls
App store launch, major version
Cloud
IAM, storage, network configuration
Migration, new accounts or tenants
Wireless and IoT
Wi-Fi, devices, firmware
New office, connected product launch
Physical
Building access, on-site controls
New facility, regulated data on site
Social engineering
Staff and help desk processes
Phishing exposure, awareness program review
Red team
Detection and response against a goal
Mature program, regulator-led testing
Black Box, Grey Box And White Box Testing
Separate from the type of test is how much information you give the testers. This choice has a big effect on cost, coverage and realism.
Black Box Penetration Testing
In black box penetration testing, the testers start with little or no knowledge: perhaps just a company name or a domain. They must discover everything themselves, as an outside attacker would. That makes it realistic, but much of the time budget goes on reconnaissance rather than deep testing, so coverage of any single application tends to be shallower. It works well for external tests and for checking what your public footprint reveals.
Grey Box Testing
Grey box testers get partial knowledge, typically user credentials, a list of in-scope hosts or basic architecture notes. This mirrors an attacker who has phished an account or an insider with normal access. For most web application and internal network tests, grey box is the best balance of realism and depth, and it is what many providers recommend by default.
White Box Testing
White box (or clear box) testers get full access: source code, architecture diagrams, configuration files and admin accounts. It is the least realistic simulation of an outsider, but the most thorough way to find flaws, because testers spend no time guessing. It suits high-risk applications, pre-launch reviews and cases where code review is combined with dynamic testing.
Approach
Tester Knowledge
Strength
Trade-off
Black box
None or minimal
Realistic outsider view
Less depth for the same budget
Grey box
Credentials, partial documentation
Balanced depth and realism
Assumes some access already exists
White box
Full code, architecture and access
Most thorough coverage
Least like a real external attack
The Penetration Testing Process, Step By Step
Providers use different labels, but a professional penetration test follows broadly the same sequence.
1. Scoping
You and the provider agree what is being tested and why: IP ranges, domains, applications, user roles, environments (production or staging), and the outcome you need, whether that is compliance evidence, assurance for a customer or a realistic view of risk. Scoping drives price and quality more than anything else. A vague scope produces a vague report.
2. Rules Of Engagement
The rules of engagement put authorization in writing. They cover testing windows, out-of-bounds systems, whether denial-of-service or destructive actions are allowed, how data found during testing is handled, emergency contacts and what happens if a critical issue is found mid-test. For cloud and hosted systems, they also confirm that testing fits the hosting provider’s policy.
3. Reconnaissance
Testers gather information about the target, both passively (public records, DNS, code repositories, leaked credentials, employee profiles) and actively (port scanning, service fingerprinting, application crawling). This is where automated tools do much of the heavy lifting. The output is a map of the attack surface and a shortlist of promising weaknesses.
4. Exploitation
Testers attempt to exploit the weaknesses they found, within the agreed rules. This is the step that separates a penetration test from a scan. A tester might combine an exposed admin panel, a default password and an unpatched component to gain a foothold, or abuse an access control flaw to read another customer’s data. Each successful step is documented with evidence.
5. Post-Exploitation
Once in, testers assess what the access is worth. Can they escalate privileges, move to other systems, reach sensitive data or persist without being noticed? Post-exploitation turns a technical finding into a business impact statement, which is what leadership needs to prioritize fixes.
6. Reporting
The report is the deliverable you are paying for. A strong one includes an executive summary in plain language, an attack narrative, each finding with severity, evidence, reproduction steps and specific remediation advice, and a clear statement of scope and limitations. Our guide to the penetration testing report shows what good looks like.
7. Remediation And Retest
After your team fixes the findings, the provider retests to confirm the fixes work and did not introduce new problems. Ask whether a retest is included in the price and within what time window. Auditors and enterprise customers increasingly want to see the retest letter, not just the original report.
[EXPERT QUOTE: White Knight Labs, John Stigerwalt, on what separates a genuinely useful penetration test from a box-ticking exercise]
Penetration Testing Standards And Methodologies
Reputable testers work to published methodologies, which gives you consistency and something to hold them to. You will see these named in proposals and reports:
PTES (Penetration Testing Execution Standard): a community standard that breaks a test into seven phases: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation and reporting. Useful as a general-purpose blueprint for any engagement.
OWASP Web Security Testing Guide (WSTG): the detailed reference for testing web applications and web services, organized into categories such as authentication, authorization, session management and input validation. Version 4.2 is the current stable release. OWASP’s MASTG plays the same role for mobile apps.
NIST SP 800-115, Technical Guide to Information Security Testing and Assessment: published by the US National Institute of Standards and Technology in 2008, it describes how to plan and run technical security testing, including penetration testing, and is often cited by US government and regulated organizations.
OSSTMM (Open Source Security Testing Methodology Manual): maintained by ISECOM, now at version 3, it takes a measurement-focused approach to testing operational security across physical, human, wireless, telecommunications and data network channels.
Industry frameworks add their own expectations. PCI DSS has published guidance on penetration testing for card environments, and regulated financial firms in Europe run threat-led tests based on TIBER-EU. A provider that cannot tell you which methodology it follows, and how it adapts that methodology to your scope, is a warning sign.
Who Needs Penetration Testing And How Often?
Any organization that stores sensitive data, runs customer-facing software or answers security questionnaires from larger customers should test. In practice, the decision is usually driven by one of four things.
Compliance Requirements
Some frameworks spell out penetration testing explicitly. PCI DSS v4.0.1 requires internal and external penetration testing at least once every 12 months and after any significant change, plus segmentation testing every 12 months (every six months for service providers). Under the EU’s Digital Operational Resilience Act (DORA), financial entities identified by regulators must run threat-led penetration testing, based on TIBER-EU, roughly every three years.
Others imply it. SOC 2 and ISO 27001 do not mandate a pen test in so many words, but auditors commonly expect evidence of independent testing, and most organizations treat an annual test as the practical baseline. The current HIPAA Security Rule does not name penetration testing as a standalone requirement, though HHS has proposed amendments that would require it at least every 12 months, so check the rule’s status before you plan. Our guide to penetration testing for compliance goes framework by framework.
Customer And Partner Demands
For many SaaS companies, the first penetration test happens because an enterprise prospect asks for a recent report or attestation letter during procurement. If that is your situation, make sure the provider’s report includes a shareable summary you can send without exposing every finding.
Significant Change
Test after major releases, cloud migrations, acquisitions, new office networks or a new authentication system. Annual testing alone leaves long gaps for teams that ship weekly, which is one reason continuous models such as penetration testing as a service have grown. Compare PTaaS vs traditional penetration testing if you release often.
After An Incident Or Near Miss
A breach, ransomware scare or suspicious activity is a strong reason to test, both to confirm the original weakness is closed and to find the next one. Smaller teams just starting out can use our small business cybersecurity checklist to get the basics in place first, so the test budget goes on real findings rather than missing patches.
How Much Does A Penetration Test Cost?
Price depends mainly on scope size, test type, black, grey or white box approach, the depth of manual work and whether a retest is included. A single small web application costs far less than an internal network test across several sites or a multi-week red team engagement. Be wary of quotes that look like scan pricing: they usually are scans. Our penetration testing cost guide breaks down typical price ranges by test type and what drives them.
How To Choose Penetration Testing Services
Penetration testing services vary widely in quality, and the difference is rarely visible on a sales call. These questions help separate strong providers from scan resellers.
Who will actually do the testing? Ask for the names and backgrounds of the testers assigned, not just the firm’s headline credentials. Recognized certifications are a useful signal; see our guide to the best penetration testing certifications.
How much of the work is manual? Ask what share of the time goes on manual testing versus automated tooling, and how they test business logic and access control.
Can we see a sample report? A redacted sample tells you more about quality than any pitch deck. Look for attack narratives, evidence and specific fixes.
Is a retest included? Confirm the retest window and whether you receive an updated report or attestation letter.
Do they have experience in our stack and industry? A firm that tests banking APIs every week will find different things in your fintech app than a generalist.
How do they handle critical findings mid-test? You want immediate notification for anything severe, not a surprise in the final report three weeks later.
What insurance and data handling do they have? Check professional liability coverage and how they store and destroy any data accessed during testing.
Active testing for a single web application or small network often takes one to two weeks, with the report following shortly after. Larger internal tests and red team engagements can run several weeks. Scoping and scheduling usually add time before testing starts, so plan ahead if a compliance deadline or customer review is coming.
Can Penetration Testing Break Production Systems?
There is some risk, which is why the rules of engagement exclude destructive actions unless you approve them and why testers coordinate windows and emergency contacts. Experienced testers avoid unstable exploits on fragile systems. If the risk is unacceptable, test a staging environment that mirrors production as closely as possible.
Is Pen Testing The Same As Ethical Hacking?
The terms overlap. Ethical hacking is the broad practice of using attacker techniques with permission. Pen testing is a specific, scoped and time-boxed engagement with a formal report. Bug bounty programs are another form of ethical hacking, but they do not replace a structured test with defined coverage.
Should I Choose Black Box Penetration Testing?
Choose black box penetration testing when you want to see exactly what an outsider can discover and exploit, such as on an external perimeter test. For applications and internal networks, grey box usually delivers more value for the same budget because testers spend their time testing rather than guessing.
How Often Should We Run A Penetration Test?
At least once a year and after any significant change is the common baseline, and it matches what PCI DSS requires. Teams that release frequently or hold highly sensitive data often test critical applications more often, or move to a continuous testing model.
Conclusion
Penetration testing gives you an attacker’s view of your systems, validated by people rather than inferred by tools. Start by deciding which assets matter most, pick the types of penetration testing that cover them, choose the right level of tester knowledge, and insist on a clear report and a retest. Done annually and after major changes, it is one of the most direct ways to find out whether your defenses work.
