What is a penetration test?

Penetration test or vulnerability scan

A vulnerability scan is an automated check for known weaknesses, such as missing patches or exposed services. It runs often and produces a long list. A penetration test is carried out by a person who tries to exploit what they find, chain weaknesses together and show what an attacker could actually reach. Frameworks usually expect both: scans on a regular schedule, and a penetration test at least once a year.

Tests are usually split by target, such as external network, internal network, web application, API, mobile app or cloud configuration. They are also described by how much the tester is told in advance: nothing (black box), some access and documentation (grey box), or full access to code and architecture (white box).

What frameworks ask for

PCI DSS is the most specific. Requirement 11.4 calls for internal and external penetration testing at least once every twelve months and after any significant infrastructure or application change, using a documented, industry-accepted methodology, by a qualified tester with organisational independence. Where network segmentation is used to reduce scope, it must be tested too.

SOC 2 and ISO 27001 do not name a frequency. Auditors still expect evidence that technical vulnerabilities are found and fixed, and an annual penetration test is the usual way to show it. DORA goes further for financial entities selected by their regulators, which must carry out threat-led penetration testing at least every three years.

What auditors check

The report on its own is not enough. Auditors and buyers want to see that the test covered the systems in scope and that the findings were dealt with.

• Scope. The test covered the systems that hold or process in-scope data.
• Authorisation. Written approval and rules of engagement were in place before testing began.
• Remediation. Each finding has an owner, a fix date and a status, prioritised by severity.
• Retest. High and critical findings were retested to confirm the fix worked.

Related terms

Threat-led penetration testing (TLPT)

Intelligence-led testing of live production systems that simulates a real attacker. DORA requires it of financial entities chosen by their regulators, at least every three years.

Responsible disclosure

Reporting a security vulnerability privately to the organisation affected and allowing time for a fix before anything is published. Most bug bounty programmes are built on it.

CAPA

Corrective and preventive action: the plan, owner and due date attached to an audit finding or incident, tracked until the fix is confirmed and the cause addressed.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.

Risk register

The list of identified risks with an owner, likelihood, impact, treatment and review date, linked to the controls that treat each one. Usually the first document an auditor asks to see.