Penetration test

What it means

A penetration test is a controlled attempt to break a system’s security with the owner’s consent. The goal is not a list of theoretical risks but proof of what an attacker actually achieves and with what consequences.

The scope is agreed in advance: external network, web application, internal network, social engineering. The output is a report with findings ranked by severity and concrete remediation steps.

A penetration test is not the same as an automated vulnerability scan or a review of firewall settings. A scan finds known flaws and lists them; a tester tries to chain weaknesses together the way an attacker would, and only then does it show whether a minor flaw leads to the whole database.

How it works in practice

For an ordinary company the most valuable target is the website and the online store, where customer data and payments live, plus a review of remote access. Basic hygiene comes first: patching, managed access and two-factor authentication.

Written consent covering scope and timing is a precondition - without it this is unauthorised access. Findings are re-tested after the fix, otherwise nobody knows whether the problem is closed.

A company running its online store on a rented platform may test only what it owns, and needs the provider’s consent under its rules for the rest. The results also help when taking out cyber insurance, because insurers’ questionnaires ask how the company checks its security.

What to watch out for

A test is a snapshot: it describes the state on the day, not permanently. After a significant change to the application or infrastructure it is repeated, and findings touching personal data are also assessed through the GDPR lens.

Testing a live system can cause an outage or change data, especially around forms and payments. So a time window and contact people on both sides are agreed beforehand, and a current data backup is verified, so that any damage can be rolled back quickly.