A pentest, or penetration test, is an authorised security test in which specialists try to exploit vulnerabilities in specific systems, under rules agreed in advance, to show what a real attacker could achieve and with what impact.
How it works
Before work starts, a scope is signed: which systems are tested, on which dates and at what times, which techniques are excluded (for example denial of service or social engineering, unless expressly authorised), who the emergency contact is and how the test is stopped if something degrades.
The specialists combine automated tools with manual validation and chain weaknesses together to see how far an attack can go. A test can be run with no prior information (black box), with full information (white box) or somewhere in between, and can focus on the external network, the internal network, web applications, the cloud or devices. The result is a report with confirmed findings, evidence, risk, the attack path and recommendations ranked by priority.
Example
An illustrative example, not a real case. A company publishes a customer portal and agrees to test only that portal and its server, at night and without denial-of-service tests. The specialists find that an administration panel is still reachable from the internet and that one account uses a weak password; with it they reach test customer data.
The report describes the steps, the evidence and the risk, and recommends closing the access, enabling multi-factor authentication and reviewing permissions. After the fixes, those points are checked again (a retest) to confirm they are closed, rather than assuming the issue is solved because a ticket was closed.
What a pentest is not
It is not an automated vulnerability scan: a scan is usually broader and repeatable, whereas a pentest validates whether a weakness is really exploitable. It does not test what was left out of scope and does not prove that no other flaws exist.
It is a snapshot in time. According to the NCSC, the UK's cyber security agency, it only validates that systems are not vulnerable to known issues on the day of the test, and its quality depends on the competence of the people doing it. A certificate or the name of a tool does not prove coverage. And without written authorisation from the owner of the systems, testing someone else's systems may be illegal.
When to call an expert
Commission a pentest when a customer, an insurer or a rule asks for it, when launching an application or a service exposed to the internet, or after major changes, and when basic patch and access management already exists: otherwise the report will fill up with avoidable findings. Ask for the scope in writing, for the testers to be independent of whoever administers the systems, and for a retest to be included.
At Impulso Tecnológico we work on diagnosis, technical controls and training: we can help with the preliminary assessment, with the technical controls that the report recommends and with training the team. See our guide to security IT audits, our cybersecurity services or tell us about your case.
Learn more
Related glossary terms: patch management, EDR and SIEM.
Official and reference sources: the NCSC guide Penetration testing, the publication NIST SP 800-115 on security testing and assessment, and the OWASP Web Security Testing Guide.