[ guide · 8 min read ]
What is penetration testing?
Penetration testing — pentest for short — is a controlled, authorized attack simulation against your systems, conducted by security specialists with a defined scope, timeframe, and rules of engagement. The goal is not to "run a scanner": it's to find real attack paths and chained vulnerabilities before a real attacker does.
1. Manual vs automated
Automated vulnerability scanners (Nessus, Qualys, Burp Active Scan) discover documented and known vulnerabilities. They are excellent at compliance baseline and continuous coverage — but they don't think.
Manual pentest finds:
- Broken business logic — skipping checkout steps, manipulating price, abusing coupon stacking;
- IDOR and cross-tenant data leakage — accessing another customer's data via ID manipulation;
- Race conditions in withdrawal, transfer, inventory counts;
- Vulnerability chaining — A + B + C combined become full compromise;
- Authentication bypass — broken MFA, OAuth misimplementation, session fixation.
Serious pentest is therefore 90% manual, 10% automated. The scanner is a starting point, not the deliverable.
2. When you need a pentest
- Compliance demand (SOC 2 Type II, ISO 27001, PCI-DSS req. 11.4, HIPAA, GDPR);
- Enterprise customer due diligence requesting an external pentest report;
- Significant architectural change (new public API, cloud migration, product launch);
- Competitor in your sector suffered a public breach;
- Last pentest is older than 12 months — or never happened.
3. What a real pentest report contains
A serious deliverable includes:
- Executive summary (3-5 pages) — risk level and business impact for C-suite and board;
- Technical detail (50-150 pages) — reproducible PoC, mitigation guidance, and direct mapping to applicable regulation;
- Attack narrative — not just "port 22 open" but "how an attacker reaches CFO's account from this exposure";
- Risk-ranked recommendations — based on real impact, not generic checklist.
4. Engagement frequency
- Web/API: per major release + annually;
- Cloud / on-prem infrastructure: annually, with semi-annual review for regulated environments;
- Post-incident: immediately after containment;
- Continuous compliance (SOC 2, ISO): annually, with retest of critical findings.
For fast-moving environments, consider Pentest as a Service (PTaaS) — continuous testing with rotating scopes.
5. How to engage us
Send your context — scope, environment, urgency, applicable regulation. Within 48 hours we return with proposal scope, timeline, and pricing. All engagements under mutual NDA, preceded by a signed Authorization to Test letter. Zero data retention 90 days after final report delivery.