What Is Penetration Testing?
A penetration test is an authorized, simulated attack against a system to find exploitable weaknesses before real adversaries do. The word that defines it is authorized: a pentest is distinguished from a crime not by its techniques but by written permission, agreed scope, and a report the owner can act on. It is offensive skill put to defensive use.
What are the phases?#
Most engagements follow a consistent arc:
- Scoping & rules of engagement — what may be tested, how, and when.
- Reconnaissance — OSINT and passive information gathering.
- Scanning & enumeration — mapping services, versions, and the attack surface.
- Exploitation — attempting to breach identified weaknesses.
- Post-exploitation — assessing impact, privilege escalation, pivoting.
- Reporting — the deliverable: prioritized, reproducible findings with remediation.
The report, not the breach, is the product. A pentest that pops a shell but cannot explain how to fix it has failed at its actual job.
What are the main types?#
| Type | Tester knowledge | Simulates |
|---|---|---|
| Black-box | None | An external attacker |
| Grey-box | Partial (e.g. a user login) | A malicious user or contractor |
| White-box | Full (source, architecture) | A thorough internal review |
How is it different from a vulnerability scan?#
A scanner lists potential issues automatically. A pentest proves which ones are actually exploitable, chains them together, and shows real impact — human judgment a tool cannot replace.
Penetration testing is the profession built on these fundamentals. For the career path, see what a penetration tester does. More at the Security Fundamentals hub.
Frequently asked questions#
What are the phases of a penetration test?
A typical test runs through scoping and rules of engagement, reconnaissance, scanning and enumeration, exploitation, post-exploitation (assessing impact and pivoting), and reporting. The report is the real deliverable — a prioritized list of findings the owner can act on, not a trophy wall of exploits.
What is the difference between black-box, grey-box, and white-box testing?
They differ in how much the tester knows up front. Black-box means no inside knowledge, simulating an outside attacker. White-box provides full access to source and architecture for depth. Grey-box is in between — some access, like a normal user account. More knowledge finds more; less knowledge is more realistic.