What is Penetration Testing?

Every engagement starts with rules of engagement: which systems are in scope, which techniques are permitted, is social engineering allowed, is denial-of-service testing off the table, what the success criteria are, and who to call if something goes wrong mid-test. Scope ranges narrow to broad. An external network pen test only probes the internet-facing perimeter. A web application test focuses on a single app against categories like the OWASP Top 10: injection, broken authentication, broken access control. An internal pen test assumes the tester already has a foothold, simulating a phished employee or a rogue insider, and tests how far they can move from there. A full red team engagement adds physical intrusion attempts and social engineering on top of technical exploitation.

The typical methodology mirrors the attacker kill chain: reconnaissance, mapping the attack surface and enumerating subdomains, employees, and technology stack, initial access through a vulnerable service, a weak credential, or a phishing pretext, post-exploitation establishing persistence and escalating privileges on the compromised system, lateral movement pivoting to additional hosts using captured credentials or trust relationships, and objective completion demonstrating access to a defined target, such as a database containing sensitive records, without actually exfiltrating real data.

The deliverable is a report, not just a list of CVE IDs. It documents each finding with reproduction steps, evidence such as screenshots, captured traffic, and extracted data samples with sensitive fields redacted, a risk rating that accounts for both technical severity and business context, and prioritized remediation guidance. A finding that lets a tester read arbitrary files is rated very differently depending on whether the target system holds customer PII or a static marketing page.

Pen testing is distinct from red teaming primarily in duration and objective: a pen test typically runs days to a couple of weeks and aims to find and demonstrate as many exploitable vulnerabilities as possible, while a red team engagement runs weeks to months and aims to test whether the SOC can detect and respond to a sustained, stealthy adversary, often deliberately avoiding noisy techniques a pen tester would use freely.