Glossary term
Penetration Testing
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Also known as: Pen test, Ethical hacking
Penetration testing is an authorised, simulated attack on a system, network or application, carried out by skilled testers to find weaknesses that real attackers could exploit before they do.
Explanation
A test begins with an agreed scope and rules of engagement: which systems, techniques and hours are allowed, and whom to call if something breaks. Testers then gather information, find weaknesses, try to exploit them, and attempt to move deeper, for example from a web server to a database. Approaches differ by what the tester knows beforehand: black-box with none, white-box with full access to design and code, and grey-box in between. Red team exercises go further, imitating a persistent adversary and also testing the defenders' detection and response. A vulnerability scan only lists known flaws, whereas a penetration test shows whether they can be chained into real harm. The report ranks findings by severity with recommended fixes, and a retest confirms closure. Auditors ask for the report and the retest, looking for each high-severity finding to be closed before the next cycle.
Example
A bank hires an external firm to test its online banking app. In two weeks the testers find that a poorly checked account number field lets a logged-in customer view another customer's statements. The firm rates the flaw high severity and reports it the same day. Developers fix it, and the testers retest to confirm that the fix works.
Not to be confused with
- Vulnerability scanning
- A scan automatically lists known weaknesses; penetration testing adds human skill to prove which ones can really be exploited and what follows.