Penetration testing

Penetration testing, or pentesting, is an authorized, simulated attack on an organization's systems. A company hires security specialists, agrees in writing on what they may touch and when, and lets them try to get in the way a real attacker would: through the website, the office Wi-Fi, a forgotten server, or a convincing phone call to the help desk. At the end they deliver a report: what they reached, how, how serious it is, and how to fix it.

The point is to find the gaps that checklists miss. An automated scanner can list software with a known vulnerability; a human tester notices that a minor bug on the login page, combined with a reused password and an overly broad permission, adds up to full access to customer data. That chain of small problems is usually how real breaches happen.

What separates a pentest from an attack is consent and rules. The scope says which systems are in and which are off limits, the rules of engagement say what is not allowed (no deleting data, no testing during the payroll run), and the client knows it is happening. Tests come in flavors: black box (the tester starts knowing nothing, like an outsider), white box (they get the source code and diagrams) and gray box in between. A red team exercise is a longer, stealthier version that also tests whether the defenders notice.

Pentests are often required by regulators, card payment rules or large customers, typically once a year and after big changes. They are a snapshot, not a guarantee: they show what one team found in a limited time. The value is in fixing what they found and retesting.