What Is Penetration Testing?

What Penetration Testing Actually Is

A penetration test is a structured engagement where security professionals — either an internal red team or an external firm — attempt to compromise a defined target environment using the same techniques, tools, and thought processes that real attackers use. The testers operate within a defined scope and rules of engagement, document their methodology and findings, and deliver a report that describes what they were able to compromise, how, and what the business impact would be if a real attacker had succeeded.

Types of Penetration Tests

Network penetration testing assesses external-facing infrastructure — web servers, VPNs, email gateways, firewalls — and internal network security. External network tests simulate an attacker with no prior access to the environment. Internal network tests simulate an attacker who has already gained a foothold inside the network, evaluating lateral movement paths, privilege escalation opportunities, and the ability to reach high-value targets like domain controllers, financial systems, and sensitive data repositories.

Web application penetration testing focuses specifically on web applications — assessing for OWASP Top 10 vulnerabilities including SQL injection, cross-site scripting, authentication weaknesses, insecure direct object references, and server-side request forgery. Application pentests require testers who understand web application architecture and can test both the application layer and the underlying infrastructure.

Social engineering assessments test the human element — phishing simulations, vishing (voice phishing), and physical security testing. These tests evaluate employee security awareness, email filtering effectiveness, and physical access controls. They are among the most consistently revealing assessments because they test the attack vector most commonly used against mid-market organizations.

Red team assessments are the most comprehensive and realistic form of security testing. Unlike a penetration test with a defined scope and time limit, a red team engagement simulates a targeted adversary pursuing a specific objective — accessing the CFO's email, exfiltrating customer data, achieving domain admin — using whatever techniques are required, over an extended timeframe, without the blue team knowing an engagement is in progress.

What a Penetration Test Actually Tells You — and What It Doesn't

A penetration test tells you what a skilled attacker with access to known tools and techniques could accomplish against your environment during the testing period. This is genuinely valuable information. It is not a guarantee that your environment is secure against all attacks, a comprehensive inventory of all vulnerabilities, a substitute for continuous monitoring and detection, or a certification that your controls are effective.

The Scope Problem

Most penetration test findings are constrained by the scope defined before the engagement begins. An organization that scopes a penetration test to exclude cloud infrastructure, third-party applications, and physical security is receiving a test against a subset of their actual attack surface. Attackers do not respect scope boundaries. The most common path to compromise in real-world attacks — credential phishing followed by cloud account takeover — is frequently outside the scope of traditional network penetration tests.

Point-in-Time vs. Continuous

A penetration test is a point-in-time assessment. The report reflects the state of your environment on the specific days the test was conducted. An organization that patches the findings from their April penetration test and then makes significant infrastructure changes in May and June is not protected by their April report. Security environments change continuously — new systems are deployed, configurations drift, new vulnerabilities are discovered — and point-in-time assessments become stale quickly.

Penetration Testing in M&A Diligence

For PE-backed companies and acquisition targets, pre-close penetration testing surfaces security exposure that questionnaire-based diligence misses. Common pre-close findings include: internet-facing systems with critical unpatched vulnerabilities, identity infrastructure misconfigurations allowing privilege escalation, network segmentation gaps allowing unauthorized lateral movement, and missing or weak authentication on administrative interfaces. These findings affect deal terms, escrow requirements, and 100-day plan investment priorities.

Penetration Testing as a Service vs. Engagement-Based

Traditional penetration testing is engagement-based: an annual or semi-annual point-in-time test producing a report. Continuous penetration testing services — PTaaS — provide ongoing testing throughout the year, surface new findings as they emerge, and produce a continuous view of security exposure rather than annual snapshots. PTaaS is increasingly the preferred model for organizations whose environments change frequently enough that annual point-in-time testing becomes outdated quickly.

Common Penetration Testing Misconceptions

Penetration testing is not the same as vulnerability scanning. Vulnerability scanning identifies known vulnerabilities; penetration testing exploits them and chains them together to demonstrate attack paths. A vulnerability scan finding of "SMB signing not required" is informational; a penetration test demonstrating that this finding enables Active Directory compromise is operationally consequential.

Penetration testing is also not the same as red teaming. Red teaming is a longer-duration, objective-based exercise that tests an organization's detection and response capabilities against simulated adversarial activity. Penetration testing is shorter-duration and focused on identifying vulnerabilities and attack paths. Both are valuable; they answer different questions.

Related Reading

• Purple Team Exercises — the collaborative offense-defense engagement model
• Vulnerability Management — the foundational visibility discipline
• Attack Surface Management — the scope-definition discipline

What is penetration testing?

Penetration testing simulates a real cyberattack against your own systems, networks, and applications to identify exploitable vulnerabilities before an actual adversary does. Testers operate within a defined scope and rules of engagement, document their methodology, and deliver a report describing what they were able to compromise, how, and what the business impact would be. It is the most direct way to validate whether security controls work under realistic attack conditions.

What are the different types of penetration tests?

External network testing simulates an attacker with no prior access. Internal network testing simulates a foothold inside the network and evaluates lateral movement. Web application testing focuses on application-layer vulnerabilities (OWASP Top 10). Social engineering assessments test the human element through phishing, vishing, and physical security testing. Red team assessments are the most comprehensive — objective-based, longer-duration, executed without blue team knowledge.

What is the difference between a penetration test and a vulnerability scan?

Vulnerability scans identify known vulnerabilities. Penetration tests exploit them, chain them together, and demonstrate the actual attack paths to high-value targets. A vulnerability scan finding 'SMB signing not required' is informational. A penetration test demonstrating that this finding enables Active Directory domain compromise is operationally consequential. Scans are automated and shallow; pentests are manual and deep.

What is the difference between penetration testing and red teaming?

Penetration testing is scoped, time-boxed, and focused on identifying vulnerabilities and attack paths within a defined target. Red teaming is objective-based, longer-duration, executed without the blue team knowing, and tests detection and response capabilities as much as technical defenses. Penetration testing finds what is exploitable; red teaming finds what is detectable.

How often should we conduct penetration testing?

Traditional cadence is annual, often driven by compliance requirements (PCI DSS, SOC 2). For modern environments that change frequently, annual point-in-time testing becomes stale quickly — by month four, the assessed environment no longer reflects the current environment. Penetration Testing as a Service (PTaaS) provides continuous testing throughout the year. Major architectural changes — cloud migrations, M&A integration, new business systems — should trigger targeted pentests regardless of cadence.

How much does a penetration test cost?

External network pentests for mid-market organizations typically range from $5,000-$25,000. Internal network plus web application testing ranges from $15,000-$75,000. Red team engagements run $50,000-$250,000 or more. The cheapest tests typically deliver scanner output reformatted as a report — paying for genuine manual testing produces operationally different findings than paying for compliance documentation.

Does penetration testing actually find what attackers will exploit?

Quality pentests do. In Cloudskope's M&A due diligence engagements, our testers achieve domain administrator privileges within 4-24 hours in approximately 84% of mid-market environments — typically through chained findings that individual vulnerability scanners would have rated low or medium severity in isolation. Tests that find nothing usually reflect scope limitations or tester quality rather than secure environments.

Real-World Example: How a 4-Hour Pentest Revealed Complete Domain Compromise

In a Cloudskope M&A due diligence engagement for a PE sponsor evaluating a 300-person healthcare technology company, our penetration testers achieved domain administrator privileges within 4 hours of beginning the internal network assessment. The path required three steps: identifying a legacy Windows Server 2008 system that had not been patched since 2019, exploiting a known vulnerability to gain an initial foothold, and using credential harvesting from the legacy system's memory to obtain a service account credential that had domain admin privileges — a configuration the organization's IT team was unaware of. The finding was material to deal valuation: achieving domain admin meant an attacker could access every system, every database, and every email account in the organization simultaneously. The sponsor used the finding to negotiate remediation obligations into the purchase agreement.