Glossary

Penetration Test

Authorised simulated cyber attack to identify weaknesses in systems.

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

A penetration test is an authorised, simulated cyber attack conducted against an organisation's systems, networks, or applications to identify security weaknesses before malicious actors can exploit them. Penetration testers use the same techniques and tools as real attackers, but operate within a defined scope and rules of engagement agreed upon with the organisation, providing a realistic assessment of security posture.

Regular penetration testing is required by numerous compliance frameworks including PCI DSS, ISO 27001, SOC 2, and NIS2. The results provide actionable findings ranked by severity, enabling organisations to prioritise remediation efforts. Penetration tests complement automated vulnerability scanning by identifying complex attack chains and business logic flaws that automated tools typically miss.

Q

R

S

T

U

V

W

Z

Frequently asked questions

What is a penetration test?
A penetration test is an authorised, simulated attack in which a tester actively attempts to exploit weaknesses in systems, applications or processes, to show what an attacker could realistically achieve.
Is a penetration test required for ISO 27001 or SOC 2?
Neither names it as a mandatory control. Both require you to verify technical security effectively, and a penetration test is the evidence most auditors and enterprise customers expect to see — so in practice it is usually part of the programme.
What do black-box, grey-box and white-box mean?
They describe how much the tester knows in advance: black-box means no internal information, white-box means full access to source and architecture, and grey-box sits between the two. More knowledge generally finds more issues per day spent.
← Back to all terms