Penetration testing is authorised, contracted security work in which an organisation deliberately hires someone to attack its own systems, using the same techniques a real malicious attacker would use, with the explicit goal of finding exploitable weaknesses before someone without permission finds them first. The entire arrangement rests on prior written authorisation defining exactly what systems are in scope and what techniques are permitted — the same actions that would be a serious crime performed without that authorisation become a legitimate, valuable security service once a client has explicitly agreed to them in advance and in writing.
A structured process, not just improvised hacking
A professional penetration test typically follows a defined methodology rather than unfolding as unstructured improvisation, generally moving through several distinct phases: reconnaissance, gathering publicly available information about the target; scanning, actively probing the target's systems to identify what's running and what might be vulnerable; exploitation, actually attempting to break in through whatever weaknesses scanning revealed; and post-exploitation, establishing what an attacker could actually do once inside, such as accessing sensitive data or moving on to other connected systems. This structured approach matters both because it gives the engagement a genuinely repeatable, comparable process across different tests and different testers, and because a defined methodology makes it much easier to stay strictly within the boundaries the client actually authorised.
The report, not the break-in itself, is the actual deliverable
Successfully breaking into a client's system isn't really the end goal of a penetration test — it's the detailed written report documenting exactly what vulnerabilities were found, precisely how each one was exploited, and what real damage or access a genuine attacker could have achieved by using it, that actually delivers the value the client is paying for. A skilled attacker who breaks in but can't clearly explain and reproduce how they did it has given the client very little they can actually act on, whereas a clear, well-documented report lets the client's own engineers understand and fix the specific underlying weakness, rather than just being told, vaguely, that some unspecified problem exists somewhere in their systems.
What we're still unsure about
The basic structure of a professional penetration test — authorisation, a defined methodology moving through reconnaissance to exploitation, and a detailed final report as the actual deliverable — is well-established, widely documented industry practice. What's more genuinely debated within the security field itself is how well a time-boxed, necessarily limited-scope penetration test actually approximates the behaviour of a real, patient, well-resourced attacker who isn't working under any such constraints — a test typically has to fit within an agreed budget and timeframe that a genuine malicious attacker simply isn't bound by, which is part of why many organisations increasingly treat penetration testing as one layer within a broader, ongoing security programme rather than as a single, sufficient test capable of finding every real weakness a determined attacker with unlimited time might eventually locate.
This sits inside Penetration Testing Methodology, one of seven topics in Cybersecurity, one of seven domains in Computer Science, one of seventeen subjects the app can quiz you on.