An authorised attempt to break in
A penetration test is a controlled attempt, by security testers you have authorised, to find weaknesses in your systems and show what an attacker could do with them. It goes further than a list of possible problems: testers try to use what they find, within limits you agree, to show the real impact on your business, such as access to customer data or to other parts of your network.
What it covers
A test covers what you choose: a web application, an API, your external or internal network, your cloud accounts, a mobile app, your Wi-Fi, or how your firewalls and staff devices are set up. Each kind looks for different things, from flaws in how an application handles permissions to weak settings and missing updates. Each service’s page describes what its test covers.
How it differs from a real attack
Testers work only on the assets you have listed and authorised, at the times you agree, and stop when you ask them to. They take care not to harm your systems or your data, and handle anything they see with care. A real attacker follows none of these rules, which is why the scope and your authorisation come first.
What you receive
Each finding describes the affected assets, its business impact, how to reproduce it and how to fix it, and is reviewed before it’s published to you. The report groups the findings by severity, so you can decide what to fix first. When you have fixed a finding, a retest confirms the fix.