A penetration test is a controlled, authorised attempt to break into a company’s systems, run specifically to find real security gaps before someone without good intentions finds them — and for most companies it’s the first step beyond automated vulnerability scanning.
Quick Overview
What you’ll learn:
- What types of penetration tests exist and which to choose first
- How to choose a vendor and what to look for in the contract
- What a good penetration test report should include
- How often a company should repeat testing
Who this article is for:
- Companies planning their first penetration test
- Security teams building a recurring testing programme
- Compliance teams preparing for a compliance audit (such as NIS2, ISO 27001)
Reading time: 6 minutes
Penetration testing: where to start as a company — the types of test
The first decision is scope, because different types of test answer different business questions. External infrastructure testing checks what someone with no prior access can see and attack — the most common choice for a first test, since it answers the most basic question: what’s visible from the internet, and can it be exploited. Web application testing focuses on a specific application (login, authorisation, input validation) following OWASP methodology. Internal testing simulates a situation where an attacker already has access to the internal network (say, via phishing) and checks how far they can move laterally. Social engineering testing probes the weaknesses of people, not systems — most often through simulated phishing or attempts at physical access to an office.
For a company with no prior penetration testing experience, a proven starting point is external infrastructure testing combined with testing the main web application — a combination that covers the most likely attack vectors without the cost and complexity of a full internal test.
How to choose a penetration testing vendor
Three things separate a credible vendor from a company selling an automated vulnerability scan under the label “penetration test.” First, methodology — a solid vendor bases its work on a recognised methodology (the OWASP Testing Guide for web applications, NIST SP 800-115 as a general security testing framework), not an undocumented, in-house process. Second, the amount of manual work involved — automated scanners find known, catalogued vulnerabilities, but the serious, real-world findings (business logic flaws, chains of smaller vulnerabilities that combine into a severe issue) require manual analysis by an experienced tester. Third, a clearly defined scope and rules of engagement — a document specifying what can be tested, during what hours, and what actions are explicitly prohibited (such as DoS attacks against production), signed before work begins.
What a good penetration test report should include
| Report element | Why it matters |
|---|---|
| Executive summary | Communicates business risk without technical jargon |
| Vulnerability list with risk rating | Prioritises by real-world impact, not just technical CVSS severity |
| Proof of concept for each vulnerability | Confirms the flaw is real, not theoretical |
| Remediation recommendations | Concrete steps, not generic “improve security” advice |
| Retest after fixes | Confirms reported vulnerabilities were actually closed |
A report without a retest section is incomplete — a list of found vulnerabilities with no confirmation that they were fixed leaves a company unsure whether it actually improved its security or simply paid for a list of problems.
How often to repeat penetration testing
Good practice, consistent with NIST SP 800-115, is to test at least once a year and after every significant infrastructure change — a new application, a cloud migration, a major network architecture change. Companies in regulated sectors (finance, healthcare, critical infrastructure covered by NIS2) often test more frequently, since compliance requirements either directly mandate frequency or an auditor treats the annual cycle as the absolute minimum.
Read Also
- NIS2: Compliance Obligations for Mid-Size and Large Companies — how penetration testing fits into NIS2 risk management requirements
- Cybersecurity Certifications: CISSP vs CEH vs Security+ — how to verify the competencies of a team running your tests
Develop Your Skills
Practical penetration testing competencies start with the training Penetration Testing - Hands-on Workshop with Kali Linux. Check the programme and sign up to develop your skills with EITT experts.
FAQ
What type of penetration test should a company choose first?
A proven starting point is external infrastructure testing combined with testing the main web application — it covers the most likely attack vectors without the cost and complexity of a full internal or social engineering test.
How does a penetration test differ from an automated vulnerability scan?
An automated scanner finds known, catalogued vulnerabilities based on signatures. A human-run penetration test additionally uncovers business logic flaws and chains of smaller vulnerabilities that combine into a severe issue — something an automated tool cannot identify on its own.
Why should a penetration test report include a retest?
Without a retest, a company has no confirmation that reported vulnerabilities were actually fixed — a vulnerability list alone, without verification of remediation, leaves uncertainty about whether the investment in testing actually improved security.
How often should a company order penetration tests?
Good practice is at least once a year and after every significant infrastructure change (a new application, a cloud migration, a major network architecture change) — companies in regulated sectors often test more frequently due to compliance requirements.