What Is Penetration Testing? The Complete Guide to Pentests
A penetration test (pentest) is an authorized, simulated attack on your own systems, performed by a certified security specialist to find and prove exploitable vulnerabilities before a real attacker does. NIST SP 800-115 defines it as security testing that mimics real-world attacks to identify ways to circumvent the security features of an application, system, or network.
This guide explains how penetration testing actually works: every type of pentest, how engagements are conducted phase by phase, the methodologies behind professional testing, what compliance frameworks expect, and what separates a real penetration test from a rebranded scan.
By the Budget Security penetration testing team · Updated August 14, 2026 · 18 min read
On this page
What is a penetration test?
A penetration test is a controlled attack on your own applications, networks, APIs, or cloud environment, carried out by a professional who uses the same techniques as a criminal attacker: probing for weaknesses, chaining small flaws into serious compromises, and attempting to reach data and systems they should never be able to touch. The difference from a real attack is that everything happens with written authorization, inside an agreed scope, and every step is documented so your team can close the holes.
The practice is almost as old as multi-user computing. In the late 1960s the US government convened task forces to study computer security, and the resulting Ware Report and the tiger teams of the 1970s formalized the idea of authorized specialists attacking systems to prove where they break. Half a century later the same principle drives every professional pentest: theory does not secure systems, demonstrated evidence does.
Companies commission a penetration test for two reasons. Compliance frameworks such as SOC 2, ISO 27001, and PCI DSS require or expect regular independent testing. And engineering leaders want proof, not hope, that their defenses hold before an attacker checks for them. A good pentest delivers both: audit-ready evidence and a prioritized, honest list of what to fix.
Ready to see what a penetration test looks like for your own scope? You can price one in our calculator in about two minutes, or keep reading to understand exactly what you would be buying.
Penetration test vs vulnerability scan: what is the difference?
The most common confusion in security buying. A vulnerability scan is software matching known signatures; a penetration test is a human proving what an attacker can actually do. Scanners are useful, and our testers use commercial-grade automated tools during every engagement, but tool output is where testing starts, not where it ends.
| Vulnerability scan | Penetration test | |
|---|---|---|
| Performed by | Software | Certified human tester using tools |
| Finds | Known, signature-matched weaknesses | Exploitable flaws incl. logic and chained attacks |
| False positives | Many, unvalidated | Removed: every finding is proven |
| Output | Raw finding list | Evidence, severity, and remediation guidance |
| Audit value | Supporting hygiene evidence | Accepted by SOC 2, ISO 27001, PCI DSS auditors |
Curious how far automation alone can go, and where it stops? We wrote a full comparison here.
Types of penetration testing
Penetration tests are scoped by attack surface. Most companies start with the surface their customers touch, then broaden. Every type below follows the same phases and standards; what changes is the target and the specialist skills involved.
External network penetration testing
Attacks your internet-facing infrastructure: firewalls, VPN endpoints, mail servers, and exposed services. The tester works from outside, exactly like an internet-based attacker.
You need this if you have any infrastructure reachable from the internet, which is almost every company.
Internal network penetration testing
Assumes the attacker is already inside: a compromised workstation, a rogue employee, or a breached VPN account. Tests segmentation, Active Directory, and lateral movement paths.
You need this if a single phished laptop should not mean the whole company is lost.
Web application penetration testing
Manual testing of your web apps against the OWASP Top 10 and beyond: broken access control, injection, authentication flaws, and business-logic abuse that scanners cannot find.
You need this if customers log in to your product. It is the most requested penetration test for SaaS companies.
API penetration testing
Targets REST, GraphQL, and internal APIs against the OWASP API Top 10: broken object-level authorization, excessive data exposure, and rate-limit bypasses.
You need this if your product exposes an API, and doubly so if mobile apps or partners consume it.
Mobile application penetration testing
iOS and Android testing: insecure local storage, weak transport security, reverse engineering resistance, and the backend APIs the app talks to.
You need this if you ship a mobile app that handles user data or payments.
Cloud penetration testing
AWS, Azure, and GCP configuration and identity testing: IAM privilege escalation, exposed storage, and the misconfigurations behind most cloud breaches.
You need this if production runs in the cloud and more than a handful of people can change its configuration.
Wireless penetration testing
Tests corporate Wi-Fi: rogue access points, weak enterprise authentication, and whether the guest network really is isolated from production.
You need this if your offices run Wi-Fi that touches anything sensitive.
Social engineering
Phishing, vishing, and pretexting campaigns that measure whether people and processes resist manipulation, not just whether machines do.
You need this if you want to know how your team responds before a real attacker tests them for you.
Physical penetration testing
Attempts to enter offices or data centers: tailgating, badge cloning, and unattended-equipment access.
You need this if physical access to your premises would expose systems or data.
IoT and OT penetration testing
Embedded devices, industrial control systems, and the protocols connecting them, where patching is hard and default credentials live forever.
You need this if you build connected hardware or run operational technology.
AI and LLM penetration testing
A newer discipline: prompt injection, model jailbreaks, training-data leakage, and abuse of AI-driven features in your product.
You need this if your product ships LLM-powered features that touch customer data or take actions.
Not sure which penetration test fits your situation? Add your asset on our platform and the scoping flow works it out with you, or compare scopes in the calculator.
Black box, grey box, and white box penetration testing
Independent of the target, every penetration test picks an access model, and the choice changes what a testing day buys you.
Black box
The tester starts with nothing but authorization, exactly like an external attacker. Most realistic, but a meaningful share of the engagement is spent discovering what exists rather than testing how it breaks.
Grey box Most common
The tester gets test accounts and documentation. This is the model most companies should choose: it preserves the attacker perspective while spending testing days on depth instead of discovery.
White box
Full transparency, including source code or infrastructure configuration. Maximum depth per day and the best fit when you need assurance on a specific critical system.
Rule of thumb: the less access you give, the more days the same coverage takes. That trade is exactly what our scoping flow makes explicit before you book.
How is a penetration test conducted?
A professional pentest is not a tester randomly hacking for a week. Engagements follow a defined sequence, based on PTES, that both sides can plan around:
- 1
Scoping and rules of engagement
Before anything is attacked, tester and client agree what is in scope, what is off limits, which credentials are provided, and how emergencies are handled. On our platform this happens when you add your asset and answer the scoping questions; the goal and boundaries are fixed before day one.
- 2
Reconnaissance
The tester maps the target: exposed hosts and services, subdomains, technologies in use, leaked credentials, and anything an attacker could learn without touching the target directly.
- 3
Scanning and enumeration
Automated tooling gets its turn: port scans, service fingerprinting, and vulnerability scanning generate leads. This is where commercial-grade automated tools earn their place, but the output is a list of hypotheses, not findings.
- 4
Exploitation
The human core of the penetration test. The tester attempts to exploit the leads: bypassing authentication, escalating privileges, chaining minor weaknesses into major compromises, and probing business logic no scanner understands.
- 5
Post-exploitation
Once in, how far does it go? The tester assesses what an attacker could actually reach: lateral movement, sensitive data access, and persistence, all within the agreed scope.
- 6
Reporting
Every finding is written up with severity (CVSS), reproduction steps, evidence, and concrete remediation guidance, plus an executive summary a non-technical stakeholder or auditor can read.
- 7
Remediation and retest
You fix the findings; the tester verifies the fixes actually closed the holes and issues updated results, the proof your auditor or customer wants to see.
Penetration testing methodologies and standards
"We hack stuff" is not a methodology. Professional penetration testing is built on published standards, which is what makes results comparable, repeatable, and acceptable to auditors. These are the ones that matter:
PTESPenetration Testing Execution Standard
Defines the seven phases of a professional engagement, from pre-engagement scoping through reporting. The de facto process backbone for the industry.
OWASP WSTGOWASP Web Security Testing Guide
The reference test catalog for web applications. Its sibling projects cover mobile (MASTG) and the OWASP API Security Top 10.
NIST SP 800-115Technical Guide to Information Security Testing
The US government's technical guide to security testing and assessment. The definition auditors and regulators point to.
OSSTMMOpen Source Security Testing Methodology Manual
A measurement-focused methodology that quantifies operational security rather than just listing findings.
MITRE ATT&CKMITRE ATT&CK framework
A knowledge base of real adversary tactics and techniques, used to map findings to the behaviors of actual threat actors.
Budget Security engagements follow OWASP testing guides and PTES, with NIST SP 800-115 alignment for clients whose auditors expect it. Ask any provider which of these they follow; a vague answer is a red flag.
What tools do penetration testers use?
Tools do the repetitive work; testers do the thinking. Our engagements combine manual testing with commercial-grade automated tooling, roughly 70% human effort and 30% automation and AI-assisted coverage. A few staples you will see in almost every professional engagement:
| Tool | What it is for |
|---|---|
| Nmap | Network discovery and port scanning: the map of what is exposed |
| Burp Suite Pro | Intercepting proxy for web and API testing, the workbench for manual exploitation |
| Metasploit | Exploitation framework for validating that vulnerabilities are actually exploitable |
| OWASP ZAP | Open-source web proxy, often used alongside Burp for automated baseline checks |
| Wireshark | Traffic analysis: seeing what actually crosses the wire |
| Hydra / John the Ripper | Credential attacks: password spraying, brute force, and hash cracking |
| BloodHound | Active Directory attack-path mapping for internal engagements |
Our pricing model
Budget Security charges a transparent day rate: $985 per tester-day for US clients, EUR 849 per day for EU clients. The number of days follows from your scope: how many applications, APIs, network segments, or cloud accounts, and how deep you want to go. Every engagement includes the full report and a retest of your fixes.
You do not have to guess what that means for your situation: the pentest cost calculator turns your scope into a fixed price in about two minutes, before you commit to anything. For the full picture of what drives penetration test budgets, read our cost guide.
How long does a penetration test take?
The industry's dirty secret is that the testing is the short part; the waiting is the long part. At traditional consultancies, the calendar from first contact to signed scope alone often runs four to eight weeks.
The actual work: a focused single-target engagement is typically three to five testing days. Combined scopes run one to three weeks. Reporting lands within days of testing completing, and a retest of your fixes takes another day or two once you have remediated.
On our platform the front end of that calendar collapses: you scope and book online, and kickoff typically happens within 24 to 48 hours. From booking to audit-ready report in about a week is the normal case for a single application, not the exception. Sign up and see the timeline for your own scope.
Penetration testing for compliance
For many buyers the trigger is an audit. Frameworks differ in what they demand from a penetration test; here is the short version for each, with a dedicated guide behind every link.
SOC 2
SOC 2 does not name penetration testing verbatim, but auditors expect it as evidence for the monitoring and vulnerability-management criteria, and enterprise customers reviewing your report will look for it. An annual pentest of the in-scope product, plus retest evidence, is the accepted baseline. Our SOC 2 guide covers scope and evidence in detail.
ISO 27001
ISO 27001 requires technical vulnerability management and control effectiveness checks; certification auditors routinely expect penetration test results as that evidence. Annual testing aligned to your statement of applicability is the norm. Details in our ISO 27001 pentest guide.
PCI DSS
The strictest of the set: requirement 11.4 explicitly mandates internal and external penetration testing at least annually and after significant changes, with segmentation testing on top. If you touch cardholder data, this is not optional. See the PCI DSS specifics.
HIPAA
HIPAA's Security Rule requires a technical evaluation of safeguards; in practice, regulators and business partners accept regular penetration testing as the credible way to demonstrate it for systems handling PHI. Our HIPAA guide explains what to test.
NIS2
The EU's NIS2 directive obliges essential and important entities to manage cyber risk with appropriate technical measures, and member-state guidance consistently lists penetration testing among them. Deadlines are already live across the EU. Read the NIS2 pentest requirements.
DORA
For EU financial entities, DORA requires regular resilience testing of ICT systems, escalating to threat-led penetration testing for significant institutions. Our DORA guide maps the tiers.
Book a Compliance-Ready Penetration Test
Scope your pentest online and get a fixed price up front. OSCP certified testers, audit-ready reports, kickoff within 24 to 48 hours.
What is in a penetration test report?
The report is the product. A professional penetration test report contains an executive summary written for management and auditors, a scope and methodology statement, and then the findings: each one with a CVSS severity score, reproduction steps, evidence of exploitation, and concrete remediation guidance your engineers can act on directly. After you fix the findings, the retest results and an attestation summary complete the package your auditor or enterprise customer actually wants to see.
We break down every section, with examples of what good findings look like, in our guide to reading a pentest report.
What makes a good penetration test?
Quality varies wildly in this market, and the worst offering is an automated scan sold at consulting prices. Whoever you buy from, hold the penetration test to this standard:
- Named certifications for the actual testers on your engagement (OSCP at minimum)
- A stated methodology you can verify: OWASP, PTES, NIST SP 800-115
- A sample report before you buy, so you know what you will receive
- Manual exploitation with evidence, not raw scanner output
- A retest of your fixes included or clearly priced
- Clear scope, rules of engagement, and data-handling terms in writing
Comparing specific providers? Our buyer's guide walks through the full evaluation, red flags included.
How to prepare for a penetration test
Good preparation is mostly good scoping. Know what you want tested and why: the application customers log into, the API partners consume, the network an attacker would land on. Decide the access model (grey box with test accounts is right for most), collect credentials and documentation, and agree rules of engagement: testing windows, off-limits systems, and an emergency contact.
The one decision that shapes everything is depth versus days. More days buy deeper coverage of the same scope; fewer days mean the tester prioritizes the highest-risk surface. Our platform makes that trade explicit: the scoping flow asks what you are protecting and proposes the coverage that fits, so you see what each added day actually buys before you book. That is deliberate design, not a sales conversation.
Internally, tell the people who need to know, keep monitoring switched on if you want detection data as a bonus, and have engineering capacity ready for remediation while context is fresh.
Who performs penetration tests?
Anyone can call themselves an ethical hacker; certifications exist so buyers do not have to take that on faith. The benchmark credential is OSCP (Offensive Security Certified Professional): a hands-on exam in which the candidate must compromise real machines in a 24-hour practical, then document the attacks in a professional report. It certifies the exact skill a penetration test requires, which is why we treat it as the entry bar for every tester on our bench, with OSWE and other advanced certifications layered on top.
Budget Security fields 30 OSCP certified penetration testers. Human testers lead every engagement and validate every finding; commercial automated tooling and AI assistance extend their reach, roughly a 70/30 split of human to automated effort. When you book through the platform, that is who shows up.
Our penetration testing services
Everything described in this guide is what we do, self-serve: scope online, see a fixed price, and get OSCP certified testers on your asset within days.
External network penetration testing
Attacks your internet-facing infrastructure: firewalls, VPN endpoints, mail servers, and exposed services. The tester works from outside, exactly like an internet-based attacker.
Internal network penetration testing
Assumes the attacker is already inside: a compromised workstation, a rogue employee, or a breached VPN account. Tests segmentation, Active Directory, and lateral movement paths.
Web application penetration testing
Manual testing of your web apps against the OWASP Top 10 and beyond: broken access control, injection, authentication flaws, and business-logic abuse that scanners cannot find.
API penetration testing
Targets REST, GraphQL, and internal APIs against the OWASP API Top 10: broken object-level authorization, excessive data exposure, and rate-limit bypasses.
Mobile application penetration testing
iOS and Android testing: insecure local storage, weak transport security, reverse engineering resistance, and the backend APIs the app talks to.
Cloud penetration testing
AWS, Azure, and GCP configuration and identity testing: IAM privilege escalation, exposed storage, and the misconfigurations behind most cloud breaches.
Get Your Penetration Test
See exactly what your penetration test would involve. Enter your scope, get a fixed price. No sales calls, no waiting.