Penetration testing is authorized probing of systems to find weaknesses, with a defined scope and a report of what was found.
The owner agrees in advance which systems may be touched, how far a tester may go, and how the results will be delivered and protected.
How it works
Testers try to show real impact inside that written scope, then they stop and explain the findings so the owner can fix them.
The work is not a license to wander into neighboring companies, to destroy data, or to keep exploiting a flaw after the demonstration is clear.
A good report names the weakness, the evidence, and the repair priority without turning the engagement into a public recipe.
Because the activity looks like an attack while it is underway, emergency contacts and a way to halt the test belong in the agreement before anyone starts.
Concrete examples
- A retailer authorizes a test of its public shop and receives a report that a forgotten admin page accepts a default credential, which is then changed.
- A bank's test is stopped at the boundary of the card network because the scope never included that partner.
- An annual test finds the same missing patch as last year, and the report is used to fix the deployment process rather than only the one server.
Protective measures
- Sign a scope, a time window, and emergency contacts before any testing begins, and keep that paper reachable during the test.
- Forbid destruction, extortion, and access beyond the named systems, and halt the work when a finding is already proven.
- Protect the report as sensitive, share it with the people who can fix the issues, and track each finding to a change.
- Use the results to improve patching, access, and monitoring, and do not treat a quiet test as proof that nothing remains.
Related articles
How an organization keeps fixes flowing after a test names a flaw is explained in What is patch management as a repeating organizational process?.
What to do when an unplanned intrusion is underway, as distinct from an authorized test, is described in What is incident response after a confirmed security incident?.
The practice a test is often asked to challenge is covered in What is network security for systems that must stay connected?.