What is Penetration Testing, and How Does It Work?

Penetration testing is a security exercise using ethical hackers rather than automated processes. Providing a deeper security review. See why

Alex Hewko
5 min read

What is Penetration Testing, and How Does It Work?

In 2021, a new organization was targeted by ransomware every 11 seconds. In addition, 18% of companies said that cybersecurity risks will have the biggest impact on their growth through 2024, and there are now three times more networked devices on Earth than humans. Knowing this, wouldn’t it be nice to have hackers on your good side?

Penetration testing gives you exactly that. Let’s explore how in more detail.

What is Penetration Testing?

Penetration testing is a one-time security exercise that tests the resilience of your application or network. It involves a team of white hat or ethical hackers who are hired to break into your application and find security vulnerabilities to exploit.

In this way, they do exactly what the bad actors would do when trying to access your application, except, penetration testers are ethical hackers. That means they’re ready to alert and inform you of vulnerabilities immediately. In some cases, pentesting providers may also offer you security remediation advice.

Penetration Testing as a Service (PTaaS) is an extended, more comprehensive form of pentesting that provides year-round coverage. Whereas a one-time pentest is great for providing a baseline of your security posture, PTaaS will test your application multiple times per year, plus provide security consulting and fix verification testing throughout the year as well.

Who Performs Penetration Tests?

Pentests are performed by penetration testers (or pentesters, for short). Pentesters are expert security engineers who understand risks such as those detailed in the OWASP Top 10. Using a combination of manual and automated testing, they can creatively apply their unique areas of expertise to locate known vulnerabilities and often even exploit new issues.

Depending on their background, penetration testers may have various areas of expertise. For example, they may be proficient at finding one type of vulnerability (such as XSS), or may excel at certain types of penetration tests (such as mobile pentests).

The Difference Between Penetration Tests and Vulnerability Scans

Vulnerability scanning and automated tools are very different from pentesting. Together, all have a place in a healthy security posture.

Vulnerability scanning tools, such as SAST, DAST, IAST and RAST, are quite common for organizations that want to quickly scale their security testing on the cheap. However, these tools aren’t able to dive as deep into code and can often miss critical vulnerabilities. As such, using only vulnerability scanning tools may actually be giving your organization a bit of security theater.

Types of Penetration Tests

Today, penetration testing essentially comes in two forms: baseline penetration testing and penetration testing as a service (PTaaS).

Baseline Penetration Testing

Baseline pentesting is better suited for clients that need a one-time check on their security. Best cases for getting a baseline pentest include:

  • A small start-up who doesn’t have the budget for more security coverage
  • A company earning compliance for the first time who needs a security assessment done as part of the compliance requirements
  • A company involved in an M&A deal who wants to use security as a measure to help valuate a company
  • A B2B company closing enterprise deals, who may be completing many vendor security questionnaires

Penetration Testing as a Service (PTaaS)

PTaaS is a more comprehensive approach to security testing, as it integrates security as part of the SDLC. As code is deployed, it is continuously tested to ensure a higher level of application security year-round. In addition, it includes consulting, more re-testing, and better access to security expertise for development teams.

Best cases for getting PTaaS include:

  • A company who wants to increase the performance and value of their application through security
  • A company who wants to integrate security as a part of the Dev/DevOps pipeline
  • A company who wants to streamline security processes across multiple projects or applications
benefits of one penetration test versus penetration testing as a service

Penetration Testing Stages

There are seven key stages in an effective pentest:

1. Reconnaissance

This stage is all about understanding the application and its unique business logic. Meetings with the client and pentest provider help ensure that all parties are well-informed about the test. The test environment must be ready at this point.

2. Threat Modeling & Custom Security Plan

Building out a threat model is essential to understand the common use cases of the application. An effective threat model can also identify security risks in the design of the application, which may be difficult to change at a later stage. But understanding these risks early helps prepare the rest of the security plan to work around them.

3. Automatic & Custom Script Developments

The fun begins. Pentesters start diving deep into the application with a mix of manual and automated approaches.

4. Identification of Zero-day Vulnerabilities

As critical vulnerabilities are identified, the client is notified immediately. Steps to reproduce the issue are shared with the client so that their development team can begin remediation as soon as possible.

5. Exploitation and Escalation

The less severe vulnerabilities found during the early stages of the pentest are exploited and escalated as much as possible without affecting the function of the application (for instance, if a pentester is testing a vulnerability and it risks taking down the entire application, they’ll take it as far as possible without creating any actual harm). Test environments and test accounts are created to prevent any real damage and exploitation to the live application.

6. Cleanup and Reporting

Upon completion, pentesters will gather all found issues, regardless of severity, into a report. A good penetration testing provider should also include steps for replicating the issue so that the client’s development team can mitigate the issue.

7. Retesting and Certification

After the report is delivered, the client may patch several vulnerabilities. A quality pentest provider will be able to retest these known vulnerabilities shortly after to verify that they have been fixed correctly or sufficiently. In some cases, the pentester may require that the client develops a complete fix, and in other cases a “band-aid” solution may suffice for critical issues that need deeper attention later.

When all is good to go, the pentest provider can offer a certificate to the client as proof of application security. This certification is essential when earning compliance such as SOC 2 or ISO 27500. It’s also helpful for closing enterprise deals or for startups that want to generate higher investor appeal.

7 steps to a successful penetration test

Penetration Testing Methods

We can now go over the two testing methods available. These include the following:


Manual penetration testing is when it is done by human hackers. This method needs to be handled by qualified security engineers, or pentesters, as described in the above sections.

Due to the time and effort involved in manual testing, this takes the longest and can be the most expensive of the two methods. However, with a highly qualified security engineer, this can also be the most thorough and deepest penetration test. This is especially true if you are eager to find new types of vulnerabilities or are willing to share some of your source code with your pentester, you are better off to go with this option.


In contrast to manual testing, automated testing is the use of software tools to conduct the pentest. It is easier to scale, more affordable, and can be applied to multiple projects for less cost. So, from an economical standpoint, this is the better option.

However, automated testing may miss more critical vulnerabilities and cannot dive as deeply into your application logic as manual testing can. Thus, it is best to combine automated testing with manual testing or some other manual security exercises, such as threat modeling or secure code review.

About the author

Alex Hewko

Get security insights straight to your inbox

Additional resources

Here to get you started

Featured Post Image

The State of Penetration Testing as a Service- 2022 Edition

Say goodbye to 300+ page penetration test reports

Providing the quality of the biggest names in security without the price tag and complications.

Book a 30 min consultation

Manual penetration testing

Full time Canadian hackers

Remediation support

CTA background