What Does a Penetration Tester Do?

On this page
  1. What does the job actually involve?
  2. What skills does it need?

A penetration tester attacks systems with permission to find the weaknesses real attackers would exploit — ethical hacking as a profession. It is one of the most sought-after roles in security, and also one of the most misunderstood: the day-to-day is far more methodical enumeration and report-writing than the movie image of nonstop dramatic exploitation.

What does the job actually involve?#

A penetration test follows a consistent arc, and the tester’s week reflects it:

  1. Scoping — agree what may be tested, and get it in writing.
  2. Reconnaissance & enumeration — the bulk of the work: mapping the target methodically.
  3. Exploitation — attempting to breach identified weaknesses.
  4. Post-exploitation — assessing real impact, escalating, pivoting.
  5. Reporting — writing up findings so the client can fix them.

That last step is the deliverable. A tester who finds everything but cannot write it up clearly has not done the job.

What skills does it need?#

SkillWhy
FundamentalsNetworking, OS, how apps work
Offensive skillsWeb and network attacks
ScriptingAutomate the repetitive
Methodical habitsThorough enumeration, good notes
CommunicationReports are the product

The penetration tester role is offense turned professional. Explore the path from the Careers & Practice hub.

Frequently asked questions#

What does a penetration tester do day to day?

Penetration testers plan and scope engagements, gather information, scan and enumerate targets, exploit weaknesses, assess impact, and — crucially — write reports that clients can act on. Much of the job is methodical enumeration and documentation, not constant dramatic exploitation. Communication and report-writing are as important as technical skill.

What skills does a penetration tester need?

Strong fundamentals in networking, operating systems (especially Linux), and how applications work; hands-on offensive skills across web and network attacks; scripting to automate; methodical enumeration habits; and clear written communication. Authorization discipline and professionalism are essential, since the role involves attacking systems legally under contract.

Sources & further reading