Penetration Testing Methodology: PTES, OWASP, NIST and Our Process

A penetration testing methodology is the documented, repeatable process a tester follows from scoping to retest, so that every test covers the same ground, can be checked by an auditor and produces evidence you can act on. Most professional methodologies are built on four public frameworks: the Penetration Testing Execution Standard (PTES), the OWASP testing guides, NIST SP 800-115 and OSSTMM. If PCI DSS penetration testing (Requirement 11.4) applies to you, Requirement 11.4.1 of v4.0.1 makes a documented methodology mandatory.

Below we compare those frameworks, walk through each phase and explain how findings are rated and retested. New to the subject? Start with what penetration testing is.

What is a penetration testing methodology?

It is the written approach that turns “try to break in” into a controlled engagement. A good pentest methodology defines how scope is agreed, which techniques suit each target, what is off limits, how findings are rated and how fixes are verified. For you as the buyer, it means full coverage, results you can compare year on year, and evidence an auditor can follow.

The NCSC’s penetration testing guidance frames a test as a way of gaining assurance that your vulnerability management processes work, not as your main way of finding vulnerabilities. That only works if you know what the test covered.

Which pentest methodology do testers use?

Most providers write their own methodology and map it to several public frameworks, because no single one covers everything. The table below compares the six penetration testing methodologies and frameworks testers rely on most.

Penetration testing methodologies compared (Sovereign Secure, reviewed October 2026)

Sources: the PTES technical guidelines, the OWASP MASTG, NIST SP 800-115, the OSSTMM 3 manual and MITRE ATT&CK, with the OWASP WSTG linked below. You are welcome to cite this comparison with a link to this page.

PTES was written by practitioners to define what a test should include. Its seven sections are pre-engagement interactions, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation and reporting. Because it describes the whole engagement rather than individual tests, many in-house methodologies borrow its structure.

The OWASP Web Security Testing Guide is the reference for application testing, with test cases for authentication, authorisation, session management, input validation, business logic, APIs and more. The OWASP Top 10 is an awareness list of risks, not a test method, so a test “to the OWASP Top 10” should still follow the WSTG.

NIST SP 800-115, the Technical Guide to Information Security Testing and Assessment (2008), adds a useful idea: a loop between discovery and attack, where each foothold leads to fresh discovery from that position, just as real attackers move through a network.

OSSTMM, from ISECOM, is measurement-led: it expresses results as metrics so you can compare your attack surface over time.

What are the phases of penetration testing?

A complete test has nine phases: the seven from PTES, plus a debrief and a retest. Each should hand you something specific:

Phases 2 to 6 loop rather than run in a line, whenever a new foothold opens new ground.

Scoping decides the value of the whole test: anything left out is untested, and how much you tell the tester changes where their time goes (see black box vs white box penetration testing). Exploitation carries the risk to live systems, so the rules of engagement should exclude techniques such as denial of service. Our checklist on how to prepare your team for a pen test covers what to have ready.

What are the 5 stages of penetration testing?

The five stages most often quoted are planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting. They simplify the same process:

Some ethical hacking courses add “covering tracks”. In a commissioned test the opposite happens: the tester logs every action and removes anything they created. The five-stage model also stops at the report, while a real engagement continues to a retest.

Does the pen test methodology change by test type?

The phases stay the same; the techniques inside them change with the target:

A network pen testing methodology, for example, runs from host discovery and service enumeration to credential attacks, then follows attack paths through Active Directory towards the systems that matter most. Our network penetration testing page shows how we run infrastructure tests.

How are penetration test findings rated?

Most testers start from CVSS, which rates technical severity from 0.0 to 10.0: Low is 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9 and Critical 9.0 to 10.0 (see our CVSS guide). CVSS measures severity, not your risk, so a good report adjusts for exposure, the data involved and whether flaws chain together, and states its rating scheme so your team can check each rating. Our guide to how to read a penetration test report shows what each section should contain.

What does PCI DSS require of a penetration testing methodology?

Requirement 11.4.1 of PCI DSS v4.0.1 says the methodology must be defined, documented and implemented by the entity, and must include:

The rest of Requirement 11.4 sets how often internal, external and segmentation tests run and who may carry them out; our PCI DSS penetration testing page covers it. The standard and the PCI SSC’s Penetration Testing Guidance supplement are free from the PCI SSC document library.

Why does the retest matter?

A test only reduces risk once its findings are fixed, and the retest proves it: the tester repeats the steps that confirmed each finding and checks the fix opened nothing new. PCI DSS Requirement 11.4.4 requires exploitable findings to be corrected in line with your risk ranking under Requirement 6.3.1, and the testing repeated to verify the corrections. Agree the retest window and scope before testing starts.

How does Sovereign Secure run a penetration test?

Our process follows the phases above in six steps:

1. Scoping: targets, roles, environment and rules of engagement agreed in writing, with the price fixed before testing starts.
2. Reconnaissance and mapping of the attack surface across every role and network position in scope.
3. Testing: manual testing backed by professional tooling, following PTES, the OWASP guides and NIST SP 800-115 as each target requires. Critical findings are flagged the day we confirm them.
4. Reporting: an executive summary and a technical report with reproduction steps, CVSS ratings and remediation advice.
5. Debrief: a walkthrough with your team on the findings, the risk and the fixes.
6. Retest of the fixed findings, with the report reissued to show them closed.

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, a Qualified PIN Assessor and a Card Production Security Assessor, and is ISO 27001 certified. As a QSA company we know what an assessor checks under Requirement 11.4, so our reports set out the methodology, scope and findings in the form that evidence needs.

Next step

Send your scope through our penetration testing quote form for a fixed-price proposal with the retest agreed up front, or call +44 161 523 5276.