What is a penetration test?

Penetration tests in plain English

Imagine hiring a security expert to break into your own office building. She rattles doors, checks windows, tests the alarm system, and looks for a key under the doormat. Whatever she manages to do, she writes down – along with tips on how to close the gaps. That is exactly what a penetration test is, just for your IT: for servers, web applications, networks, and cloud services, but also for processes that involve people.

The name refers to penetrating an organization’s defenses – in other words, getting in. In everyday use, people usually just say pentest, and the experts who carry it out are called penetration testers or pentesters. They think like attackers, but they work on your behalf and stick to rules agreed in advance.

A pentest is more than an automated vulnerability scan. A scanner compares systems against lists of known flaws – much like an inspector with a checklist who checks whether every window has a lock. A pentest goes further: experts check by hand whether a vulnerability can really be exploited, whether several small weaknesses combine into a dangerous attack path, and what an attacker could ultimately achieve. For an overview of the different test types, visit our Penetration Testing page.

How a penetration test works

Reputable pentests follow a set process. Public frameworks provide guidance – for example, the “Durchführungskonzept für Penetrationstests” (implementation concept for penetration tests) from the BSI (Germany’s Federal Office for Information Security) or the OWASP Testing Guide, a freely available methodology for testing web applications.

1. Define objectives and scope: Together, you clarify what will be tested and what won’t. This framework is called the scope. It also covers time windows, contact persons, and off-limits areas, such as particularly sensitive systems.
2. Obtain written authorization: Without the system owner’s consent, the very same activities can be a criminal offense – in Germany, for example, as data espionage under Section 202a of the German Criminal Code (StGB). That’s why the ground rules – known as the rules of engagement – are put in writing beforehand.
3. Gather information: The testing team explores the targets. Which services are reachable from the internet? Which software is running, and in which version?
4. Find and exploit vulnerabilities: Using tools – but above all experience and manual work – the team searches for gaps. Promising findings are exploited in a controlled way, often with an exploit, a piece of attack code. Only this shows whether a vulnerability is real.
5. Document the results: The pentest report describes each vulnerability in a way that can be traced and reproduced, rates its risk, and recommends specific countermeasures.
6. Verify the fixes: Once the gaps have been closed, a retest checks whether the measures really work.

How much the testing team knows in advance determines the test perspective. In a black-box test, the team starts with no prior knowledge, just like an outsider. In a gray-box test, it receives test accounts, for example; in a white-box test, it gets full insight, right down to the source code. Tests can cover online shops, interfaces (APIs), apps, networks, Wi-Fi, cloud environments, AI applications, and industrial systems – and, with social engineering tests, how easily people can be deceived.

A practical example

A fictional but typical scenario: A mid-sized online retailer commissions a pentest before launching its new customer portal. An automated scan had previously found nothing unusual. The pentester signs in with an ordinary test account and changes an order number in the browser’s address bar. Suddenly, he sees another customer’s invoice – including name, address, and the items ordered.

To a scanner, this flaw is invisible, because technically everything works. Only a human recognizes that the application doesn’t check who an order belongs to. Experts call this IDOR. The testing team reports the finding immediately, the development team fixes it before go-live, and the retest confirms the fix. Had it gone undetected, attackers could have used this route to retrieve the data of the entire customer base.

Why does this matter for businesses?

Attackers need only a single open door. A penetration test shows you these doors before someone else finds them – and it shows which of them are truly dangerous. That way, you spend your budget where it has the greatest impact.

There are also external requirements. There is no general legal obligation to conduct pentests in Germany. However, many regulations call for the effectiveness of security measures to be reviewed regularly, such as Art. 32 of the GDPR, the NIS2 requirements, or the ISO/IEC 27001 standard. For financial entities, the EU’s DORA regulation mandates a testing program, and the card payment standard PCI DSS 4.0.1 explicitly requires penetration tests. Customers, partners, or insurers may also ask for proof.

What to look out for

• A clear objective: Decide what the test should achieve – for example, evidence for an audit or securing a new application before launch.
• A well-defined scope: A precisely described scope makes quotes comparable and prevents surprises.
• Real manual work: Ask how much manual testing goes into the test. An automated scan with a new label is not a pentest.
• Written authorization: Make sure there is a written engagement that covers objectives, time frame, and off-limits areas. For hosted systems, the rules of the hosting or cloud provider also apply.
• An understandable report: A good report includes an executive summary for management and a technical section with evidence and remediation measures.
• Plan for a recheck: Clarify in advance whether a retest of the remediated vulnerabilities is included.
• Test regularly: As a rule of thumb, test at least once a year and additionally after major changes, such as a move to the cloud.

How Rootsektor can help

As a Germany-based security company, Rootsektor performs penetration tests for web applications, APIs, networks, cloud environments, AI applications, and industrial systems, among others – manually and based on recognized standards. After scoping, you receive a fixed-price quote, and the retest of remediated vulnerabilities is free of charge. You’ll find all test types under Penetration Testing, and you can describe your scope on our Pentest Quote page.