Authorised simulated attack to evaluate security by exploiting vulnerabilities as a real attacker would.
Penetration testing (pen testing) involves authorised security professionals attempting to exploit vulnerabilities in systems, networks, or applications—simulating real attacks to evaluate security effectiveness. Unlike vulnerability scanning (which identifies weaknesses), penetration testing demonstrates exploitability and potential impact. Pen tests range from black box (no prior knowledge) to white box (full system information). Results identify not just vulnerabilities but attack paths, privilege escalation opportunities, and defence gaps. Penetration testing is often required for compliance and provides valuable insight beyond automated scanning.
Why It Matters
The DSC Perspective:
Penetration testing shows what attackers could actually achieve, not just what's theoretically vulnerable. It's required or recommended by most compliance frameworks. Annual pen testing is minimum; critical systems or significant changes warrant more frequent testing.