A penetration test is an authorised, scoped and time-boxed attempt to find and exploit weaknesses in a defined system, and to report on them in enough detail that the owning engineering team can fix them. It answers a narrow question: within the scope agreed, what could a competent attacker achieve, and how would the organisation know? Everything outside that scope — supply chain, insider misuse, physical access, the systems the tester was not allowed near — is not covered by the report, however comprehensive the report looks.
The main flavours, and what each is for
| Type | Target | Typical question answered |
|---|---|---|
| External network | Internet-facing infrastructure | What can an unauthenticated attacker reach and exploit from the internet? |
| Internal network | Corporate LAN, assumed foothold | Once an attacker is inside, how far can they get, how quickly? |
| Web application | Specific web app or API | Are there OWASP-class flaws that permit account takeover, data exfiltration or privilege escalation? |
| Mobile application | iOS/Android app plus backend | Is client-side or transport-layer data exposed; can the API be abused through the app? |
| Cloud configuration | AWS/Azure/GCP tenant | Are IAM, storage and network controls set up to resist misuse of a compromised identity? |
| Red team | The organisation, over weeks | Can the blue team detect and evict a realistic adversary before objectives are met? |
What a penetration test is not
- It is not a compliance certificate. Cyber Essentials, ISO 27001 and PCI-DSS use pen test findings as evidence, but the test itself certifies nothing.
- It is not a guarantee of security after the test date. Every configuration change, deployment or new dependency after the report is delivered is out of scope.
- It is not the same as a vulnerability scan. Scans are automated, unfocused and produce raw output; a test is human-driven, scoped and produces analysed findings.
- It is not a substitute for logging, patching and staff training — the controls that determine whether a real intrusion is detected and contained.
- It is not incident response. If you find yourself asking a pen tester to investigate a live intrusion, you need a forensic examiner instead.
When to commission one
- 01Before a significant release. A new externally exposed service, a payment flow or a customer portal warrants a targeted application test before it is put in front of users.
- 02After a merger or acquisition. The acquired estate is unknown; an internal and external test establishes a factual baseline for integration risk.
- 03In response to a regulatory or contractual expectation. Enterprise customers, financial regulators and public-sector frameworks increasingly require annual independent testing on a defined scope.
- 04After a suspected incident, to confirm remediation. Once forensic investigation and remediation are complete, a scoped test verifies the fix and hunts for adjacent weaknesses the attacker may have used or planned to use.
- 05Annually on the crown-jewel systems. The systems whose compromise would end the business get a fresh, human-driven look every year, on a scope that reflects how they have changed.
How to scope an instruction that produces value
- State the question in one sentence: "Can a customer with a valid account escalate to admin?" is scopable; "Test our security" is not.
- Define the target precisely: URLs, IP ranges, application versions, in-scope and explicitly out-of-scope components.
- Give the tester the credentials and documentation a real attacker would obtain: authenticated testing finds an order of magnitude more than unauthenticated.
- Agree the rules of engagement in writing: permitted techniques, hours of testing, points of contact, escalation criteria for genuine incidents discovered during testing.
- Require a written report with reproduction steps, severity, business impact and remediation guidance for every finding — not a scanner export.
A pen-test report that could have been produced without touching the target system is not a pen-test report. If every finding is a generic CVE description with no reproduction path, the engagement was a scan.
What good testers deliver alongside the report
The report is the artefact, but the value is in the debrief. A good testing team walks the engineering owners through each finding, agrees the remediation approach, and re-tests the fixes once they land. The organisations that get the most from testing treat it as a conversation with their engineering teams, not as a compliance drop.
Frequently asked questions
External network tests on a small perimeter start around £4,000–£7,000; a focused web application test typically £8,000–£20,000; a multi-week red team £40,000 and up. Price tracks scope, tester seniority and the depth of reporting.
CREST or NCSC CHECK for network and infrastructure testing; CREST OVS or OSCP/OSWE-qualified individuals for application work. The individual tester's credentials matter more than the firm's logo wall.
A properly scoped test on production has a small but non-zero risk of disruption. High-risk techniques (denial of service, destructive exploitation) are almost always excluded on production; where realism requires them, they run against a staging environment.
As a snapshot: the moment it is delivered. As a useful reference: until the next significant change to the tested system. Annual re-testing is the common cadence for material systems.
They can, but there is a conflict-of-interest argument for separating the two on any regulated or high-stakes matter — the responder should not be marking their own homework.