Penetration Testing

Noun · Security & Infosec · Origin: 1967

Definitions

Penetration Testing (also called pentesting or ethical hacking) is a sanctioned, systematic process of probing a computer system, network, or web application to find security vulnerabilities that an attacker could exploit. Unlike automated vulnerability scanning, penetration testing involves skilled security professionals using creativity, technical expertise, and the same tools and techniques as malicious hackers to simulate real-world attacks. The process typically follows defined phases: reconnaissance (gathering information about the target), scanning (identifying open ports and services), exploitation (attempting to breach security controls), post-exploitation (assessing the impact of a successful breach and lateral movement possibilities), and reporting (documenting findings with severity ratings and remediation guidance). Testing methodologies include black box (no prior knowledge), white box (full access to source code and architecture), and gray box (partial information). Organizations conduct penetration tests for regulatory compliance (PCI-DSS, HIPAA, SOC 2), risk assessment, and validating that security investments are effective.
In plain English: Hiring friendly hackers to try to break into your systems before the bad guys do, then telling you what they found.
Example: "We hired a pen test firm and they got domain admin in four hours. Money well spent."