Cybersecurity

What is Penetration Testing?

Quick answer

An authorized, simulated cyberattack on a system to find and fix security weaknesses before real attackers exploit them.

Penetration Testing, explained

Penetration testers, sometimes called ethical hackers, use the same techniques as criminals but with permission and a defined scope. A test might target a web application, a corporate network, cloud configurations, a mobile app, or even physical security and staff through social engineering.

A typical engagement includes planning and scoping, reconnaissance to gather information, scanning for vulnerabilities, attempting exploitation to see how far an attacker could get, and a report with findings and recommended fixes. Tests can be black box, with no inside knowledge, or white box, with full access to code and documentation. Penetration testing differs from automated vulnerability scanning because humans chain weaknesses together creatively. Many regulations and standards require regular testing.

Related terms

Guides that mention Penetration Testing