What is penetration testing?
Penetration testing is an authorised security assessment that attempts to identify exploitable weaknesses in systems, websites, or networks.
Simple example
A business asks for its external website and login portal to be tested before launching a new client feature.
Why it matters
A good penetration test helps prioritise realistic security fixes and gives better visibility into exposure.
Common warning signs
- The activity is unexpected or unusual for the business context.
- The request or system behaviour creates pressure to act quickly.
- Normal approval, verification, or security processes are bypassed.
- There are signs of unauthorised access, data exposure, or system change.
- Staff are unsure whether the request, message, or system behaviour is legitimate.
Cyber Doc view
This term should be understood in business context, not only as a technical issue. Good protection usually combines clear processes, appropriate technical controls, staff awareness, and a calm response plan.
What to do
Proactive steps
- Define the scope and rules clearly before testing.
- Test important systems before major changes or launches.
- Fix findings based on risk.
- Retest serious issues after remediation.
- Keep reports and evidence for governance or insurance discussions.
Reactive steps
- If a real attack is suspected during a test, pause and confirm scope.
- Preserve test logs and communications.
- Separate test findings from incident evidence.
- Fix confirmed weaknesses promptly.
- Use results to improve controls and processes.
Related terms
- Vulnerability assessment
- Attack surface
- Remediation