A penetration test, or pen test, is a simulated cyberattack against a computer system, network, or web application. The goal isn't just to find weaknesses; it's to actively exploit them to see how far an attacker could get. Think of it as hiring a professional burglar to test your home security. They don't just tell you a window is unlocked, they'll try to climb through it and see what they can access.

This makes it different from a vulnerability assessment, which is more like a security checklist. A vulnerability assessment uses automated tools to scan for known weaknesses and produces a list of potential problems. A pen test goes a step further by using a human tester who thinks creatively, chains together multiple low-risk vulnerabilities, and tries to gain control of systems, mimicking the actions of a real attacker.

Because penetration testing involves actively trying to break into systems, it operates under a strict ethical and legal framework. This is what separates a pen tester from a malicious attacker. The core principle is consent. You must have explicit, written permission from the system owner before you begin any testing. This permission is documented in a contract that outlines the 'scope of engagement'.

The scope defines the rules. It specifies which systems are fair game, what techniques are allowed, and what times the test can be conducted. Straying outside this scope isn't just unprofessional; it can be illegal. In the UK, for example, unauthorised access to computer material is a criminal offence under the Computer Misuse Act 1990 and similar laws exist worldwide. Ethical hacking is about being methodical, responsible, and always staying within the agreed-upon boundaries.

Not all penetration tests are the same. The approach you take depends on how much information you're given about the target system. There are three main types.

Black-box testing is the most realistic simulation of an external attack. The tester is given almost no information about the target, perhaps just a company name or an IP address. They have to discover everything from the outside, just like a real attacker would.

White-box testing is the opposite. The tester has full access to source code, architecture diagrams, and other internal documentation. This allows for a much more thorough examination of the system's logic and design, but it doesn't simulate an external attacker's perspective.

Grey-box testing sits in the middle. The tester is given some information, like a user account, to simulate an attack from someone with insider access. This is useful for understanding the threat posed by a disgruntled employee or a user whose credentials have been stolen.

Regularly conducting these tests helps organisations find and fix security holes before malicious actors do. It validates security controls, demonstrates the real-world impact of vulnerabilities, and helps prioritise security spending on the risks that matter most. It's a critical part of a mature cybersecurity programme.

Ready to check your understanding?