Penetration testing
Also known as: pen testing, pentest, pen test, penetration test
Penetration testing, or pen testing, is an authorized simulated attack on an organization's systems, networks, applications, or people, carried out by security professionals to find weaknesses before criminals do.
Testers try to break in using the same techniques attackers use, then report what they found and how to fix it. While pen tests give a realistic view of risk, they're a snapshot in time, and their value depends heavily on scope and the skill of the testers.
Penetration testing, explained at three levels
At home
A pen test is like hiring a locksmith to try breaking into your house, with your written permission. They test each door and window, see how far they get once inside, then hand you a report listing which locks failed and how to fix them. In computing, the house is an organization's networks, websites, and staff accounts, and the locksmith uses the same tricks real criminals use.
At work
Penetration testing is an authorized, simulated attack on a company's systems by security professionals. Testers use the same tools and tricks as criminals to find weak passwords, unpatched servers, or website flaws, then show how far an attacker could get and how to fix each gap. Businesses buy pen tests to find problems before criminals do, and often to satisfy customers, insurers, or regulators.
At home
A pen test follows a planned path. Testers first gather information about the target, then scan for open services and known weaknesses. Next they try to exploit what they found, for example by guessing weak passwords or abusing a website flaw, and see how far a foothold takes them. Throughout, they record evidence. The written scope and authorization are what separate a test from a crime, and they spell out exactly which systems, dates and techniques are allowed.
At work
Tests are defined by target and knowledge. External tests attack what the internet can see, internal tests assume an attacker is already inside, and others focus on web applications, cloud tenants, wireless networks or staff through social engineering. Black-box testers start with nothing, grey-box testers get a normal user account, and white-box testers get source code and diagrams. Most follow published methods such as the PTES or OWASP testing guides, and findings are ranked by severity with evidence and remediation steps.
At home
Pen testers hold a legal permission slip that ordinary people do not. The same scan or password guess that is a paid service under a signed contract can count as unauthorized access to a computer under Canada's Criminal Code without one. That is why practice environments exist: deliberately vulnerable labs and capture-the-flag contests let you learn the same techniques legally. In my view, they are the only right place to start if security work interests you.
At work
A pen test is a point-in-time sample, bounded by scope, time and tester skill, so a clean report does not mean a secure environment. Its value comes from realistic scoping, such as testing from an assumed-breach position rather than only the perimeter, and from retesting fixes. Unlike a red team, which tests whether defenders notice a goal-driven attack, a pen test aims for breadth of findings. Programmes that pair periodic tests with continuous scanning and attack-surface monitoring catch far more between engagements.
Real-world examples
At home
Thomas, a computer science student in Waterloo, practised pen testing skills on legal online labs before landing a summer job at a security consultancy.
At work
Lena is security lead at a Toronto fintech startup. An annual pen test found that an old test server was exposed to the internet with default credentials, which her team shut down that week.
How it compares
| feature | Penetration testing | Vulnerability scanning |
|---|---|---|
| Approach | Humans actively try to break in | Automated tools list known flaws |
| Depth | Chains flaws together | Surface-level findings |
| Frequency | Periodic, often yearly | Continuous or weekly |
| Cost | Higher | Lower |
Scanning finds known holes. Pen testing shows what an attacker could actually do.
For analysts
I'd tie pen test scope to real business risks, such as 'can an outsider reach payroll data?', instead of testing whatever is easiest. Then track every finding to closure.
History & origin
The US military and government ran 'tiger teams' to probe computer security in the late 1960s and 1970s, and a 1972 report for the US Air Force by James P. Anderson laid out methods for testing system defences. Security consultancies offered commercial penetration testing in the 1990s as businesses connected to the internet. Tools such as Nmap (1997), Metasploit (2003), and Burp Suite (2003) became standards. Payment card rules under PCI DSS, introduced in 2004, required regular penetration tests for businesses handling cards, pushing adoption. Certifications such as OSCP, launched in 2006, professionalized the field. In my view, a good pen test report is one of the most useful documents a security team can receive, provided someone actually fixes the findings.