What is penetration testing?
Penetration testing is an authorized, simulated attack on an organization’s systems, applications or people, performed by security specialists to find and safely exploit vulnerabilities before real attackers do. Unlike an automated scan, a penetration test proves which weaknesses can actually be used, how far an attacker could get, and what to fix first.
The U.S. National Institute of Standards and Technology (NIST) describes penetration testing as security testing in which assessors mimic real-world attacks to find ways around an application’s, system’s or network’s security features (NIST CSRC glossary). The work is always authorized in writing and bounded by agreed rules of engagement.
This guide answers the questions security and compliance leaders ask most about penetration testing (also called pentesting or a pen test): why it matters, how the process works, which types exist, how often to test, and how to choose a provider.
Penetration testing at a glance
| Question | Short answer |
|---|---|
| What it is | An authorized, human-led simulated attack that confirms which vulnerabilities are exploitable |
| Who performs it | Qualified internal or third-party testers (common credentials: OSCP, GPEN, GWAPT, CREST) |
| Core methodology | NIST SP 800-115 phases; OWASP Web Security Testing Guide for web applications |
| Main output | A report with an executive summary, risk-rated findings, evidence and remediation steps |
| Common drivers | PCI DSS, SOC 2, ISO 27001, HIPAA, customer due diligence, cyber insurance |
| Baseline frequency | At least every 12 months and after significant changes |
Why is penetration testing important for companies?
Penetration testing is important because it shows a company which of its weaknesses an attacker could actually exploit, not just which ones exist. It validates that security controls work, produces evidence auditors and customers ask for under frameworks like PCI DSS and SOC 2, and lets leaders fund the fixes that reduce the most risk.
Most companies already run vulnerability scanners, endpoint detection and firewalls. Those tools report what might be wrong. A penetration test answers the harder question: if a motivated attacker targeted us today, what could they reach?
What does a penetration test find that scanners miss?
Automated scanners match known signatures. Human testers reason about context, which surfaces issues such as:
- Broken access control: one user reading or changing another user’s data by altering an ID in a request (an IDOR flaw).
- Business logic flaws: skipping a payment step, applying a discount twice, or approving your own request.
- Chained weaknesses: several low-severity issues combined into a path to sensitive data or domain administrator access.
- Credential and identity weaknesses: weak or reused passwords, excessive privileges and misconfigured single sign-on.
- Gaps between policy and reality: controls that exist on paper but are not enforced on every system.
Who in the organization benefits?
| Role | What a penetration test gives them |
|---|---|
| CISO | Evidence of real exposure to brief the board and prioritize the security roadmap |
| IT director | A specific, ranked list of systems and configurations to fix |
| Compliance lead | Third-party testing evidence for audits and customer questionnaires |
| Engineering lead | Reproducible findings with steps to fix them in code or configuration |
Read more: Penetration Test vs Vulnerability Assessment: What’s the Difference and When Do You Need Each?
How does penetration testing help my business?
Penetration testing helps a business by turning security risk into a prioritized, evidence-backed fix list. It supports compliance audits, answers customer security questionnaires, reduces the chance and cost of a breach, informs security budgets, and gives leadership a clear picture of exposure before a deal, product launch, audit or insurance renewal.
The value shows up in business outcomes, not just in the security team:
| Business outcome | How a penetration test supports it |
|---|---|
| Pass audits | Supplies third-party testing evidence for PCI DSS, SOC 2, ISO 27001 and HIPAA reviews |
| Close enterprise deals | Gives sales a current report summary or attestation letter for vendor security reviews |
| Reduce breach risk | Finds exploitable paths to sensitive data so they are closed before an attacker finds them |
| Spend the security budget well | Ranks fixes by real-world impact, so money goes to the riskiest gaps first |
| Launch safely | Tests a new application, API or feature before customers and attackers see it |
| Support insurance and M&A | Documents security posture for underwriters, investors and acquirers |
How do I measure the return on a penetration test?
Track outcomes you can verify: critical and high findings remediated, time to remediate, repeat findings between tests, and audits or customer reviews passed with the report. Over successive tests, fewer repeat findings and faster fixes show the program is working.
What are the steps in a penetration testing process?
A penetration test follows four core phases defined in NIST SP 800-115: planning, discovery, attack and reporting. In practice, providers expand these into scoping and rules of engagement, reconnaissance, vulnerability identification, exploitation, post-exploitation, reporting and remediation verification, with web application testing structured around the OWASP Web Security Testing Guide.
NIST Special Publication 800-115, the Technical Guide to Information Security Testing and Assessment (September 2008), is the most widely referenced public framework for how a penetration test should run. The OWASP Web Security Testing Guide (WSTG) adds a detailed catalogue of what to test in web applications and APIs. The table maps each practical step to both.
| Step | What happens | NIST SP 800-115 phase | OWASP WSTG reference |
|---|---|---|---|
| 1. Scoping and rules of engagement | Agree targets, exclusions, test windows, contacts, escalation for critical findings and written authorization | Planning | Testing framework and scope (WSTG Introduction) |
| 2. Reconnaissance | Gather public and technical information: domains, IP ranges, technologies, exposed services | Discovery | Information Gathering (WSTG-INFO) |
| 3. Vulnerability identification | Combine automated scanning with manual analysis of configuration, authentication and code paths | Discovery | Configuration and Deployment Management (WSTG-CONF), Identity Management (WSTG-IDNT) |
| 4. Exploitation | Safely attempt to exploit confirmed weaknesses to prove impact | Attack: gaining access | Authentication (WSTG-ATHN), Authorization (WSTG-ATHZ), Session Management (WSTG-SESS), Input Validation (WSTG-INPV) |
| 5. Post-exploitation | Escalate privileges, move laterally and show what data or systems an attacker could reach | Attack: escalating privileges, system browsing, installing additional tools | Business Logic (WSTG-BUSL), API Testing (WSTG-APIT) |
| 6. Reporting | Deliver an executive summary, risk-rated findings, evidence and remediation guidance | Reporting | WSTG Reporting chapter |
| 7. Remediation verification | Retest fixed findings to confirm they are closed (where included in scope) | Post-testing activities: mitigation | WSTG Reporting chapter |
How does the NIST attack phase work?
NIST SP 800-115 describes the attack phase as a loop of four activities: gaining access, escalating privileges, system browsing, and installing additional tools. Each new foothold feeds back into discovery, because access to one system reveals new targets. This loop is what separates a penetration test from a scan: testers keep going until they reach the agreed objective or exhaust the realistic paths.
What should a penetration test report include?
- An executive summary written for non-technical leaders: overall risk, key themes and priorities.
- Scope, dates, methodology and any limitations.
- Each finding with a severity rating (commonly CVSS), affected assets, evidence and steps to reproduce.
- Specific remediation guidance for each finding.
- Strategic recommendations that address root causes, not just individual bugs.
Are there other penetration testing methodologies?
Yes. Common alternatives and complements include the Penetration Testing Execution Standard (PTES), the Open Source Security Testing Methodology Manual (OSSTMM), the OWASP Mobile Application Security Testing Guide (MASTG) for mobile apps, and the PCI Security Standards Council’s penetration testing guidance for cardholder data environments. Most providers combine NIST SP 800-115 for the overall process with OWASP guides for application-level test cases.
What are the main types of penetration testing?
The main types of penetration testing are external network, internal network, web application, API, mobile application, wireless, and social engineering testing, plus red team engagements that test detection and response. Tests are also classified by tester knowledge: black box (no prior information), gray box (partial access) and white box (full documentation and credentials).
| Type | What it tests | Choose it when |
|---|---|---|
| External network | Internet-facing systems: firewalls, VPNs, remote access, exposed services | You need to know what an outside attacker can reach |
| Internal network | Systems behind the perimeter, Active Directory, segmentation and lateral movement | You want to see what a compromised laptop or insider could do |
| Web application | Authentication, access control, session handling, input validation and business logic (OWASP WSTG) | You run customer-facing or internal web apps |
| API | REST and GraphQL endpoints, authorization per object and function (OWASP API Security Top 10) | Your product or integrations depend on APIs |
| Mobile application | iOS and Android apps, local data storage and the backend they call (OWASP MASTG) | You ship a mobile app that handles accounts or payments |
| Wireless | Wi-Fi configuration, guest network isolation, rogue access points | You have offices, warehouses or clinics on Wi-Fi |
| Social engineering | Phishing, phone pretexting and other attacks on people and processes | You want to test security awareness and reporting |
| Red team | Objective-based, stealthy attack simulation that tests detection and response | Your controls are mature and you want to test your security team, not just your systems |
For Microsoft 365 environments, Canary Trap runs a Microsoft 365 security controls review, which assesses tenant configuration against security best practice. Physical intrusion testing is scoped as its own engagement, separate from red teaming.
What is the difference between black box, gray box and white box testing?
- Black box: testers start with only a company name or target list, like an outside attacker. Realistic, but time is spent on discovery.
- Gray box: testers receive user-level credentials or limited documentation. The most common choice for applications, because it balances realism with coverage.
- White box: testers receive architecture details, source code or admin access. Gives the deepest coverage in the shortest time.
How is a penetration test different from a vulnerability assessment or a red team?
| Vulnerability assessment | Penetration test | Red team | |
|---|---|---|---|
| Goal | List known weaknesses | Prove which weaknesses are exploitable and their impact | Test whether the organization detects and responds to a realistic attack |
| Method | Mostly automated scanning | Manual testing plus tools | Stealthy, goal-driven attack simulation |
| Scope | Broad | Defined systems or applications | Defined objectives (for example, reach a specific data set) |
| Who knows | IT team | IT and security team | A small group of leaders; defenders are usually not told |
| Output | Prioritized vulnerability list | Validated findings with evidence and fixes | Attack narrative, detection gaps and response lessons |
Read more about each type:
- Internal Penetration Testing: What It Shows That External Testing Cannot
- Application penetration testing
- API Penetration Testing: What It Is and When You Need It
- Wireless Penetration Testing: What It Tests and When It Matters
- Social Engineering Testing: What It Is and What It Actually Validates
- Red Team Engagements: Phases, Rules of Engagement, Timeline and Cost
- Red Team vs Pentest vs Purple Team: Which Should You Buy First?
- Microsoft 365 Security Review: What Gets Checked and How It Differs from a Cloud Pentest
How often should I conduct penetration tests?
Most organizations should conduct a penetration test at least once every 12 months and after any significant change, such as a new application release, major infrastructure change or acquisition. PCI DSS v4.0.1 sets this annual-plus-significant-change baseline for in-scope environments; higher-risk or fast-releasing companies often test quarterly or per major release.
The right cadence depends on the frameworks you answer to and how fast your environment changes.
| Driver | What it expects | Reference |
|---|---|---|
| PCI DSS v4.0.1 | Internal and external penetration tests at least every 12 months and after significant changes; segmentation testing every 12 months, or every 6 months for service providers | Requirement 11.4 (PCI SSC document library) |
| SOC 2 | No fixed frequency in the Trust Services Criteria; annual third-party testing is the common auditor expectation | AICPA Trust Services Criteria |
| ISO/IEC 27001:2022 | Risk-based; no fixed interval. Testing supports technical vulnerability management and security testing controls | Annex A 8.8 and 8.29 |
| HIPAA Security Rule | Periodic technical and nontechnical evaluation of safeguards; penetration testing is a common way to meet it | 45 CFR 164.308(a)(8) (HHS) |
| DORA (EU financial entities) | Threat-led penetration testing at least every 3 years for entities identified by their authority | Regulation (EU) 2022/2554, Article 26 (EUR-Lex) |
| FedRAMP | Annual penetration testing for authorized cloud service offerings | FedRAMP penetration test guidance |
When should I run an extra penetration test?
Schedule an additional test, outside the annual cycle, when any of these happen:
- A new application, major feature or public API goes live.
- You migrate infrastructure, change identity providers or restructure the network.
- You acquire a company or connect a new partner’s systems.
- You recover from a security incident and need to confirm the fix.
- A customer, auditor or insurer asks for current testing evidence.
How often should SaaS companies with continuous deployment test?
Teams that release weekly often combine an annual full-scope test with targeted tests of major releases, plus automated scanning in the CI/CD pipeline between tests. The annual test satisfies auditors; the release-based tests keep findings current.
Read more: SOC 2 Penetration Testing: Requirements, Scope, Cost and How to Choose a Firm and ISO 27001 Penetration Testing: Requirements, Annex A Controls and What Auditors Expect
Are there industry-specific penetration testing services?
Yes. Industry-specific penetration testing aligns scope, methods and reporting with a sector’s regulations and threat profile, such as PCI DSS for retail and payments, HIPAA for healthcare, DORA and FFIEC guidance for financial services, and SOC 2 or ISO 27001 for SaaS. The testing techniques are similar; the scope, evidence and reporting differ.
| Industry | Common drivers | What testing typically emphasizes |
|---|---|---|
| Financial services and fintech | PCI DSS, DORA, FFIEC guidance, SOC 2 | Payment flows, APIs, authentication, fraud-relevant business logic |
| Healthcare | HIPAA Security Rule | Patient portals, access to protected health information, segmentation of clinical and connected devices |
| Retail and e-commerce | PCI DSS | Checkout and payment pages, cardholder data segmentation, account takeover |
| SaaS and technology | SOC 2, ISO 27001, customer due diligence | Tenant isolation, access control between customers, APIs and integrations |
| Government and public sector | FedRAMP and agency-specific requirements | Boundary protection, identity, documented evidence for authorizing officials |
| Manufacturing and industrial | IEC 62443, cyber insurance | IT-to-OT segmentation, remote access, safe testing windows for production systems |
What should an industry-specific test change?
- Scope: systems the regulation covers, such as the cardholder data environment under PCI DSS.
- Method: safe testing windows for production, clinical or operational systems that cannot go down.
- Evidence: findings mapped to the control IDs your auditor will check.
- Reporting: a summary written for the regulator, auditor or customer who will read it.
How do I choose a penetration testing company?
Choose a penetration testing company by checking tester qualifications, methodology, reporting quality and fit with your compliance needs. Ask who will do the testing, which standards they follow (NIST SP 800-115, OWASP), how much is manual versus automated, what a sample report looks like, and whether remediation guidance and retesting are included.
Use this checklist to compare proposals side by side.
| Criterion | What good looks like | Question to ask |
|---|---|---|
| Tester qualifications | Named, experienced testers with recognized certifications (OSCP, OSCE3, GPEN, GWAPT, CREST) | Who exactly will test our environment, and what are their credentials? |
| Methodology | A documented process mapped to NIST SP 800-115 and OWASP | Which methodology do you follow, and can we see it? |
| Manual depth | Human-led testing, with scanners used only to support it | What share of the work is manual testing? |
| Reporting | An executive summary plus technical findings with evidence, severity and fixes | Can we see a redacted sample report? |
| Scoping | A scoping conversation before the quote, with clear rules of engagement | How did you arrive at this scope and effort? |
| Communication | Immediate escalation of critical findings during the test | What happens if you find something critical mid-test? |
| Compliance fit | Findings mapped to the frameworks you report against | Will the report satisfy our PCI DSS, SOC 2 or ISO 27001 auditor? |
| Remediation support | Guidance your team can act on, with retesting options stated up front | Is a retest included, and how is it scoped? |
| Data handling | NDA, secure storage and deletion of test data, professional insurance | How do you protect and dispose of our data and findings? |
What are the red flags when choosing a penetration testing provider?
- A quote based only on IP or page counts, with no scoping conversation.
- A “report” that is mostly unedited scanner output.
- No named testers, or testers who change without notice.
- No written authorization or rules of engagement before testing starts.
- Findings without evidence or steps to reproduce.
What affects the cost of a penetration test?
Cost follows effort, and effort follows scope. The main factors are the number and complexity of targets, the test type, the depth of testing (black, gray or white box), compliance reporting needs, testing windows and whether retesting is included. When comparing quotes, compare the scope, tester seniority and report quality you get, not just the price. The lowest quote often reflects less manual testing.
Read more: SOC 2 Penetration Testing: Requirements, Scope, Cost and How to Choose a Firm
Frequently asked questions about penetration testing
Is penetration testing necessary for small businesses?
If a small business handles payment cards, health data or customer data for larger clients, penetration testing is often required by PCI DSS, HIPAA evaluations or customer contracts. Even without a mandate, a focused test of the most exposed systems (usually the website, email and remote access) finds the gaps attackers target first.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment uses mostly automated tools to list known weaknesses. A penetration test goes further: testers try to exploit those weaknesses to prove real impact and show how they chain together. Most mature programs run both, with assessments more often and penetration tests at least annually.
How does penetration testing help with compliance?
Penetration testing provides independent evidence that security controls work. PCI DSS requires it explicitly (Requirement 11.4). SOC 2, ISO 27001 and HIPAA do not set a fixed interval, but auditors commonly accept a recent third-party report as evidence for testing and monitoring controls.
Can a penetration test cause downtime?
A well-run test is designed not to. Rules of engagement define approved testing windows, excluded systems and any techniques that are off limits, such as denial-of-service attacks. Testers stop and escalate if they find something that could affect stability.
Should I use penetration testing software or a service provider?
Software automates discovery and known checks, which is useful between tests. A service provider adds human judgment: chaining issues, testing business logic and explaining impact. Auditors and customers usually expect a human-led test by a qualified third party.
What should I prepare before a penetration test?
Confirm the scope and business objectives, name a technical contact, provide test accounts for authenticated testing, tell your hosting providers if their terms require notice, and agree on how critical findings will be escalated.
Talk to a penetration testing team
Canary Trap has delivered penetration testing since 2020, with methodology grounded in NIST SP 800-115 and the OWASP testing guides. If you are planning your next test, preparing for an audit, or comparing providers, talk to our team about scope and objectives.
