Penetration test
A penetration test is an authorised, mostly manual attack on a system to find and prove exploitable vulnerabilities. Definition, types, process and the report.
Updated This page as Markdown
In short
A penetration test (pentest) is a time-boxed, authorised security test in which experienced testers attack a system the way a real attacker would, exploit the weaknesses they find and document the impact. Unlike a vulnerability scan it is mostly manual, follows a defined scope and ends with a report that proves each finding and rates its severity. It is a snapshot of one version at one point in time, not a certificate.
What is a penetration test?
A penetration test is an authorised attempt to break into a system, application, device or network in order to find security weaknesses and show what an attacker could do with them. NIST SP 800-115 describes it as security testing in which assessors mimic real-world attacks to identify ways of circumventing the security features of an application, system or network. Three words matter: authorised, goal-driven and proven. The owner has agreed in writing, the testers pursue an attacker’s goals rather than a checklist, and every finding is demonstrated, not assumed.
A pentest has a defined scope (which systems, which methods, which time window), a start and an end, and a report. The report is the product: each vulnerability with reproduction steps, evidence, a severity rating (usually CVSS) and a recommendation.
Where is it defined?
There is no single binding standard, but a handful of documents set the common expectations. NIST SP 800-115, the Technical Guide to Information Security Testing and Assessment, defines the phases planning, discovery, attack and reporting. The OWASP Web Security Testing Guide and the OWASP Mobile Application Security Testing Guide list the test cases for web and mobile targets. The Penetration Testing Execution Standard (PTES) describes the full engagement from pre-engagement to reporting. The German BSI has published a practical guide for IS penetration tests that many public-sector tenders reference.
Regulation increasingly expects testing without prescribing a method. NIS2 lists “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” in Article 21(2)(f). The Cyber Resilience Act requires manufacturers to “apply effective and regular tests and reviews of the security of the product” (Annex I, Part II, point 3). In Germany, § 202c StGB (the “hacker paragraph”) makes written authorisation a legal necessity, not a formality.
What it means in practice
The value of a pentest depends on scope and tester skill, not on the tool list. Three things we see across projects:
- Scope decides the result. A test of the public web application that excludes the API behind it misses most modern bugs. Say what the crown jewels are and let the testers go for them.
- Manual work finds the serious bugs. Scanners find missing patches and known CVEs. Authorisation flaws, business-logic errors, chained weaknesses and anything in a proprietary protocol need a person. In embedded and automotive projects this is almost everything: a UDS service that skips the security access check will never show up in a scan.
- The report has two readers. Management needs the risk on one page; developers need the request, the response and the fix. A good report delivers both and is followed by a retest after the fixes.
A pentest is a snapshot. It shows the state of one version at one point in time. Products that change need a test at every major release, and systems with high exposure need a yearly test plus continuous scanning in between.
Common misunderstandings
A penetration test is not a certificate and does not make a product “secure”. Zyberum, like any testing company, issues a report, not a certification. It is also not a red team exercise: a pentest tries to find as many vulnerabilities as possible in a known scope, a red team tests detection and response against one objective. And it is not a vulnerability scan with a nicer PDF; if the offer is a few hours and a tool export, it is a scan.
FAQ
Frequently asked questions
How long does a penetration test take?
A web application or API test typically takes 5 to 15 tester days, an embedded device or ECU 10 to 25 days including the hardware work. From the scoping call to the final report, plan four to eight weeks. The scoping call fixes the number of days and the price.
Is a penetration test required by law?
Rarely under that name. NIS2 (Article 21), the Cyber Resilience Act (Annex I, Part II), IEC 62443 and ISO 27001 all expect regular testing of security measures, and auditors and customers then ask for a current report. In practice a pentest is the simplest evidence that you test.
What do I need to prepare before the test?
Written authorisation from the system owner, a test environment or an agreed window for production systems, a contact on each side who can be reached during the test, and test accounts for every user role. For devices: two or more units, firmware, documentation and, where possible, debug access.
Sources
Related pages
- GlossaryVulnerability scanA vulnerability scan is an automated check of systems against a database of known weaknesses. What scanners find, what they miss, and how to use them well.
- GlossaryRed teamingRed teaming is a goal-based, covert attack simulation that tests detection and response, not just vulnerabilities. Definition, frameworks, difference to a pentest.
- ComparisonsPenetration Test vs Vulnerability Scan: What Each Finds and When to Use WhichA vulnerability scan finds known weaknesses automatically; a penetration test finds what a scanner cannot. Differences in depth and cost, and when to use which.
- InsightsHow to Read a Pentest Report: Severity, Proof, What to Fix FirstWhat a good penetration test report contains, how to read CVSS scores in context, in which order to fix findings, which parts go to whom, and the signs of a weak report.
- InsightsIs a Penetration Test Legal in Germany? § 202c ExplainedPenetration testing is legal in Germany with written authorisation. What the Hackerparagraf (§ 202c StGB) says, why permission matters, and the planned reform.
- ServicesWe break in. You get the proof and the fix.Hands-on penetration testing by OSCP-certified engineers: IoT devices, ECUs, industrial systems, web, cloud and networks. Fixed-price offer after a 15-min call.
