Contents
Introduction
If you have landed here, you probably want to understand how penetration testing actually works before you commit to one. This guide is written for exactly that: it explains what a pentest is, the different forms it takes, the five stages a typical test moves through, and how to tell a good provider from a weak one. Cybersecurity carries a lot of jargon, so if a term trips you up, our cybersecurity glossary has plain definitions for most of it.
When you are ready to arrange a test rather than read about one, our UK penetration testing services page covers the practical side. Everything below is the background that helps you make that decision well.
What is penetration testing?
Penetration testing, or pen testing, is a proactive and authorised form of ethical hacking, where a qualified tester is hired to seek out and safely exploit vulnerabilities in a computer system. Whatever they find is reported back to you and fixed, which closes the gap before a real cybercriminal can use it.
There is also a physical side to the discipline, where a physical penetration test involves a tester attempting to reach a restricted area in person rather than over the network. This guide focuses on the digital kind, which is what most organisations mean when they talk about a pentest.
One misconception is worth clearing up straight away. The point of a pentest is not to hack things for the sake of it. It is to give you assurance about where you stand, and honest evidence of your weak points is far more useful coming from someone you hired than from an attacker who found them first.
Why does penetration testing matter?
A pentest gives you a clear view of your digital weaknesses so that you can manage the risk and patch what needs patching. The scale of the threat it protects against is not abstract. In the UK government’s Cyber Security Breaches Survey 2025/2026, published in April 2026, 43% of businesses reported a breach or attack in the previous twelve months, which is roughly 612,000 organisations.
Many organisations avoid testing out of a fear of what it might reveal, which is understandable but backwards. A provider is there to help you, and finding a flaw in a controlled test is the best possible outcome, because the alternative is finding it during a genuine attack.
The types of penetration testing
There are several types of pentest, each with its own approach and purpose. The three most common are defined by how much the tester knows going in.
Black box testing, sometimes called closed or opaque box testing, is a blind test where the tester works with no prior knowledge of your systems. It is designed to mimic a real cyberattack as closely as possible.
White box testing, also called open or glass box testing, is the opposite. The tester has full knowledge of the system’s design and works through it in a targeted, surgical way. It is not meant to imitate a real attacker, but to be thorough.
Grey box testing, or translucent box testing, sits between the two. The tester has partial knowledge of the environment, which is often the most realistic picture of an attacker who has already gained a foothold.
Red teaming and purple teaming
Red teaming is closely related to penetration testing but is not quite the same thing. A red team simulates a real attack as accurately as possible, starting with no inside knowledge and working towards a defined objective by whatever means the rules of engagement allow. The organisation’s internal defenders, known as the blue team, are usually kept in the dark, which tests detection and response as well as the systems themselves. Our guide to red teaming covers this in more depth.
Purple teaming flips that dynamic. Here the attacking and defending sides collaborate openly, pooling their knowledge to find weaknesses and improve defences together. If you want that kind of collaborative exercise delivered in practice, our red and purple teaming service sets out how it runs.
What a penetration test can target
The short answer is almost anything digital. Since that is not very helpful on its own, here are the most common targets, each of which we cover in more detail elsewhere.
- Network testing looks for weaknesses across your internal and external network infrastructure. Our network penetration testing guide explains how it works, and the network penetration testing service page covers arranging one.
- Web application testing targets the apps you run online, which are a frequent target given how many are public-facing. See our web application penetration testing guide for the detail.
- Social engineering testing goes after the human element, often through phishing, because people are frequently the easiest way in.
- Cloud testing assesses cloud-based systems across the perimeter, the internal environment and any on-premises infrastructure that supports them.
- Internet of Things (IoT) testing examines connected devices and the networks they sit on, which often ship with weak default security.
Newer targets are appearing too, such as large language model testing for the AI systems now being built into products. The target changes, but the aim never does, which is to find and report weaknesses so they can be fixed.
The five stages of the penetration testing process
Most pentests move through five stages: reconnaissance, scanning, vulnerability assessment, exploitation and reporting. This sequence does not map perfectly onto every test, particularly web and mobile app work, but it is the clearest way to understand how a pentest is structured.
Reconnaissance
This stage is about gathering information, where the tester learns as much about the target as they can, including IP addresses, network layout, operating systems and applications, then uses it to plan an effective approach. Reconnaissance comes in two forms: active, which involves interacting with the target directly, and passive, which draws on publicly available open-source intelligence without touching the systems.
Scanning
Next the tester probes the target to see how it responds and to identify open ports and possible entry points. Much of this can be automated, though automation has real limits, which is why a scanner is a starting point rather than the whole job. In a white box test, you may have already handed over the points you want checked; in black box, grey box and red team work, uncovering them is a core part of the exercise.
Vulnerability assessment
This is the last of the planning stages. The tester combines everything learned so far to work out which weaknesses are most exploitable and how to go after them. To judge severity and priority, testers draw on resources such as the National Vulnerability Database (NVD), which catalogues known software vulnerabilities from the public CVE list. If you want to go deeper on this stage specifically, our guide to vulnerability assessments is a good next read.
Exploitation
Now the tester attempts to exploit the weaknesses they have identified, simulating a genuine attack. Crucially, the aim is never to damage or disrupt anything, only to establish how serious each weakness really is. Alongside their own findings, testers lean on established methodologies to make sure nothing is missed, including:
- The OWASP Web Security Testing Guide, used mainly for web app and some IoT work. Our guide to the OWASP Top 10 explains the best-known part of it.
- The Open Source Security Testing Methodology Manual (OSSTMM), used across everything from network testing to social engineering.
- The NIST SP 800-115 technical standard, widely used as a reference for infrastructure testing.
Reporting
Once testing is finished, the tester removes any trace of their activity and leaves the environment as they found it, then writes up their findings. A good report grades each vulnerability by severity, often using the Common Vulnerability Scoring System (CVSS), and it is then up to you to decide what to fix and what to accept. Perfect security is rarely realistic, and choosing where to spend your effort is a legitimate part of the process, which we explore in our piece on non-perfect cybersecurity.
Tools and techniques
The tools used in a pentest depend heavily on the type of test and the target. Every provider keeps its own mix of open-source, commercial and in-house tooling, but a few names do come up almost everywhere.
Nmap maps networks and finds open ports and running services. Because a single IP address can have 65,535 ports, checking them by hand is impractical, so a scanner handles the groundwork. Nessus, along with scanners such as Qualys and Rapid7’s Nexpose, compares what it finds against large databases of known weaknesses and flags matches. To understand how those weaknesses map onto everything you expose to the internet, our explainer on what an attack surface is is worth a look.
Manual versus automated testing
Manual pentests are carried out by an expert; automated pentests use software to scan systems for known issues. The common misunderstanding is that manual testing avoids automation altogether, which is not the case. A manual tester uses the same scanners, but adds something a scanner cannot: an understanding of context. That is what lets an experienced tester spot an irregularity a tool has waved through as safe.
Notably, this difference is not theoretical. In our oil and gas case study, a manual test uncovered a serious flaw that automated scanners had passed over. Our guide to automated versus manual penetration testing breaks down when each approach makes sense.
The benefits of penetration testing
The most obvious benefit is remediation. Whether the weakness is a misconfiguration or a risky staff habit, understanding it means you can close it, and that alone usually justifies the investment.
Compliance is the second as regular testing demonstrates due diligence and proactive risk management, and it is expected under frameworks such as PCI DSS, HIPAA and the GDPR. If your obligations are compliance-driven, it is worth reading up on the specific standard that applies to you before you scope a test.
The third is trust, because testing regularly helps keep client and employee data safe, and that protection underpins your reputation. Few things damage an established organisation as quickly as a preventable data breach.
Common misconceptions
Testers do not fix the vulnerabilities. A pentester’s role is to find weaknesses and advise on remediation, not to patch them. Some agencies will fix issues as a separate paid service, but your own developers and IT team usually know the system better and can act more cheaply, so remediation normally sits with them.
A pentest is more than an external infrastructure test. External testing is one type of pentest, not the whole thing. It is also a mistake to picture a pentest as simply trying to get past a firewall, especially now that remote working and cloud infrastructure have made the traditional perimeter far less clear-cut.
A clean report is not wasted money. Organisations often hope a test finds nothing, then feel short-changed when it does. That reaction gets it exactly wrong, because a report with few findings is the best kind to receive. You are paying for assurance, and confirmation that your defences hold is precisely that.
How often should you run a penetration test?
As a rule, test as often as your budget allows, particularly if you make frequent changes to your systems, since every change can introduce a new weakness. For most organisations, an annual pentest is the sensible minimum. If you cannot test everything each year, rotating what you cover (the external network one year, the internal the next, and so on) is a reasonable compromise, as long as you accept it leaves some areas unchecked for longer.
How to choose a penetration testing provider
Once you understand what a pentest involves, choosing a provider becomes much easier. The single most useful filter is accreditation. Look for CREST-accredited providers and CREST-qualified testers, or use CHECK, the NCSC‘s list of approved penetration test suppliers. CHECK services are delivered by staff holding NCSC-approved qualifications, using methods the NCSC recognises, so the scheme is a reliable shortcut to a trustworthy supplier and, in turn, a better test and better remediation advice.
Where to go from here
You now have the full picture: what penetration testing is, the types available, the five stages of the process, the tools involved, and how to pick a provider. If you would like to see how a test is scoped and delivered in practice, our UK penetration testing services page is the place to start, and you can always book a call to talk through what your organisation actually needs.
