What Is Penetration Testing? The Phases, Types and Limits

A customer's security questionnaire asked for one, or the insurer did, or a compliance deadline did. So you request quotes, and three firms come back with three prices for what sounds like the same job. One is running an automated scan. One is testing a single web application by hand for two weeks. One wants to phone your staff and walk into your office. All three are calling it a penetration test, and all three are entitled to. The word describes an exercise, not a fixed product, and the scope is where every dollar of the difference lives.

What Is Penetration Testing?

NIST gives the definition of record in SP 800-115, the Technical Guide to Information Security Testing and Assessment: penetration testing is security testing in which assessors mimic real world attacks to identify methods for circumventing the security features of an application, system or network. It often involves launching real attacks on real systems and data using the tools and techniques attackers use.

The part of that definition people skip is the next sentence. Most penetration tests look for combinations of vulnerabilities across one or more systems that give more access than any single vulnerability would. That is the whole value. A list of individual flaws is a scan. A test tells you that a forgotten staging server, a reused password and a permissive file share add up to a route into payroll.

NIST is also honest about the cost in a way vendor pages are not. Testing is labor intensive, and systems may be damaged or rendered inoperable during one, even when the organization benefits from learning how. Experienced testers reduce that risk and nobody eliminates it, which is why the first phase is paperwork.

What Are the 5 Phases of Penetration Testing?

Most descriptions list five, and they are broadly the same five, sitting between two steps that get less attention than they deserve.

Search results will give you four phases, five phases and seven phases, which reads like disagreement and is not. The counts differ because different documents draw the boundaries in different places.

Two details from NIST change how you read a proposal. Attack and discovery form a loop rather than a line, because a successful exploit reveals new systems that then have to be discovered and analyzed in turn. And reporting is not a phase at the end: the assessment plan is written during planning and logs are kept throughout, which is why a firm that cannot show you a sample report is telling you something.

PTES is the standard most testing firms name in a proposal, and its seven sections put the commercial reality first, with pre-engagement interactions ahead of intelligence gathering. Its main page was last edited in 2014 and a version two has been pending ever since, so treat it as a stable checklist rather than current guidance. For anything web facing the live standard is the OWASP Web Security Testing Guide, a framework of best practices at stable version 4.2 whose individual tests carry identifiers in the form WSTG followed by a category and a number. A report citing those identifiers is a report you can check.

Types of Penetration Testing

Two different questions get answered with the word "type", and confusing them is how buyers end up with the wrong test. The first is what gets attacked.

• Network testing. External testing takes on what faces the internet. Internal testing starts from a position inside, simulating a stolen laptop or a contractor's connection.
• Web application and API testing. One application, tested by hand against the OWASP guide. The most commonly bought test, and the one compliance usually means.
• Wireless testing. The office network, guest network separation, and anything still running old authentication.
• Physical testing. Doors, badges, reception, server rooms. NIST notes that testers doing this should be able to prove their authorization to a guard on the spot.
• Social engineering testing. Phishing simulations, calls to the help desk, password resets requested for someone who is not there.
• Cloud and configuration testing. Identity permissions, storage buckets, and whether one compromised workload reaches the rest of the account.

The second question is how much the tester is told before starting.

NIST adds a third axis that matters more than either: overt against covert. Overt testing runs with the knowledge and consent of your IT staff, which limits the impact and turns the test into a training exercise. Covert testing runs without their knowledge but with the full knowledge and permission of upper management, and its purpose is to examine the damage an adversary can cause rather than to catalogue vulnerabilities. Covert tests are the ones that need a named point of contact who can stop a real incident response at two in the morning.

Penetration Testing vs Vulnerability Scanning

This is the comparison that decides your budget, and it is the one nobody explains before the invoice arrives.

Both belong in the same program, on different cycles. The federal answer for companies holding customer financial information sits in the FTC Safeguards Rule, which at 16 CFR 314.4(d)(2) requires annual penetration testing and vulnerability assessments at least every six months, unless continuous monitoring replaces them. That cadence is a sensible baseline even where the rule does not apply to you.

Is Penetration Testing Illegal?

Without written authorization, yes. The Computer Fraud and Abuse Act makes it a federal crime to intentionally access a computer without authorization or to exceed authorized access, and nothing about good intentions changes the elements of that offense. The technique a paid tester uses on Tuesday is the same technique that is charged as a crime on Wednesday. Authorization is the entire difference.

That authorization has a name in the standards. NIST defines rules of engagement as the detailed guidelines and constraints on the execution of a security test, established before testing starts, giving the test team authority to conduct defined activities without needing additional permission. In practice the document lists the systems in scope, the addresses testing will come from, the hours, the techniques that are off limits, the named contact who can call a halt, and the signature of somebody with the standing to authorize it.

Three practical consequences. You cannot authorize testing of a system you do not own, so a cloud provider's infrastructure and a partner's network need their permission, not yours. Covert testers carry proof of authorization, because the people who find them will be your own staff or the police. And scope creep is not a gray area: NIST's guidance is that the plan is followed unless specific permission to deviate has been obtained.

Who Performs Penetration Tests?

Almost always an outside specialist, because the value comes from someone with no prior knowledge of how the system was built and no stake in the answer. The trade name for the role is ethical hacker, which describes the permission rather than the technique. Larger organizations also run an internal team and use external testing to check its work.

There is no single license to look for, so buyers use the certifications as a proxy, and OSCP and the CREST qualifications are the ones requiring a practical exam rather than a multiple choice paper. Ask for the certifications of the individuals assigned to your test, not the firm's.

The Bureau of Labor Statistics does not track penetration testers as a separate occupation. The closest published figure covers information security analysts, whose median annual wage was $129,180 in May 2025, with employment projected to grow 21 percent between 2025 and 2035. Experienced testers sit above that median, which is the honest explanation for what a two week engagement costs.

What Happens After a Penetration Test

The report is the product. A useful one gives every finding a severity rating, the exact steps to reproduce it, evidence that it worked, the business consequence in plain language, and specific remediation guidance rather than "apply the vendor patch". It also states what was tested and what was not, which is the section to read first.

Then the work starts. Fixes get owners and dates, the high severity items go first, and the tester retests to confirm. A retest clause in the original contract costs far less than a second engagement, and without one the findings tend to sit. Where the report points at architecture rather than a patch, the answers are structural: multi-factor authentication on the accounts that were reused, and per application access instead of network membership where one foothold reached too far.

How to Buy a Penetration Test

The quote you get is a function of the scope you write, so write it before you ask. These are the questions that separate a real engagement from a scan with a cover page.