What Is Penetration Testing? How Pen Tests Work, Types and Costs

What is penetration testing? It is an authorised, simulated cyber attack on your systems, carried out by a skilled tester using the same tools and techniques as a real attacker, to find the weaknesses that can actually be exploited and show how to fix them before someone else finds them.

It is also called pen testing, pentesting or a pentest, and it is one form of ethical hacking: the tester is an ethical hacker working with your permission. What separates it from a real attack is permission, limits and a report: the tester works within a written scope and agreed rules, avoids anything that would damage your systems or data, and tells you exactly what they got into and how.

A widely cited penetration testing definition comes from the NCSC, which frames a penetration test as a way of gaining assurance about a system’s security, by trying to breach it the way an attacker would (NCSC penetration testing guidance). The important word is assurance: a pen test checks that your patching, configuration and security controls actually work. It does not replace them.

What is penetration testing in cyber security?

In cyber security, a penetration test is a time-boxed, scoped and authorised attempt to break into a defined target, such as a website, a network, a cloud account or a mobile app. Every test has the same building blocks: a scope listing what may and may not be tested, rules of engagement (testing times, banned techniques such as denial of service, emergency contacts), written authorisation before testing starts, and a report with evidence, a severity rating and a fix for each finding.

What a tester adds is judgement: an automated scanner checks for known patterns, while a person notices when a page works exactly as built but shows data it should not. The penetration testing examples below show what that looks like in practice.

Why is penetration testing important?

Penetration testing is important because it shows which weaknesses an attacker could actually use, and what they would reach, before a real attacker finds out. Most organisations commission a pen test for one of five reasons:

• To find exploitable weaknesses before an attacker does, especially on internet-facing systems.
• To check that a change was made safely, such as a new release, a cloud migration or new remote access.
• To meet a standard, regulation or contract that requires or expects independent testing.
• To give customers, auditors and insurers evidence: a recent report and a retest showing findings closed.
• To decide where to spend on security, using findings ranked by real business impact.

How does a penetration test work?

A test starts with scoping and written authorisation, moves through reconnaissance to map what is exposed, then discovery and manual analysis to find weaknesses, and controlled exploitation to prove which ones matter. It ends with a report, a debrief and, once fixes are in, a retest. Testers follow published frameworks such as PTES, the OWASP testing guides and NIST SP 800-115, and PCI DSS Requirement 11.4.1 expects a documented methodology of this kind. Our guide to penetration testing methodology covers each stage in detail.

What are the five stages of a penetration test?

The five stages usually quoted are a simplified version of the published frameworks:

1. Planning and reconnaissance: agreeing scope and authorisation, then mapping the targets.
2. Scanning: finding live systems, services and candidate weaknesses.
3. Gaining access: safely exploiting weaknesses to prove what they allow.
4. Maintaining access: showing how far an attacker could go from that foothold, within the agreed limits.
5. Analysis and reporting: writing up each finding with evidence, a severity rating and a fix.

The five-stage model stops at the report; a complete engagement adds a debrief and a retest of the fixed findings. Our penetration testing methodology guide maps the stages to PTES and NIST SP 800-115.

What are the main types of penetration testing?

Tests are usually described by their target: external network, internal network and Active Directory, web application (including website penetration testing for WordPress, Shopify and other CMS sites), API, mobile app, cloud, wireless, hardware and IoT, AI and LLM applications, and social engineering, which tests people rather than technology. They are also described by how much the tester is told in advance: black box (nothing), grey box (credentials and some documentation) and white box (full detail, often including source code), as our guide to black box vs white box testing explains. A red team exercise is a broader, objective-led attack that also tests detection and response; our comparison of red teaming vs penetration testing explains when each fits. Our comparison of the types of penetration testing shows which test fits which risk.

Penetration testing examples

These five scenarios are illustrative. They show the kind of finding each type of test is designed to uncover, not the results of any client engagement.

In a real report, each finding comes with evidence, a severity rating and a fix, and the attack narrative shows how individually minor issues combine into a serious one.

How is a pen test different from a vulnerability scan or an audit?

Similar-sounding activities answer different questions:

Scanning and testing work together: scans catch new known issues between tests, and tests prove what an attacker could do with them. A vulnerability assessment adds an analyst’s review to the scan, and VAPT services combine an assessment with a penetration test in one engagement.

When is penetration testing required?

It depends on which standards, regulations and contracts apply. They fall into three groups:

In the UK there is no general legal requirement to commission a penetration test. In practice, most requirements arrive through card payments, customer contracts and insurers. If you take card payments, our PCI DSS penetration testing page explains Requirement 11.4 in full, and the standard itself is free from the PCI SSC document library. DORA’s text is published on EUR-Lex as Regulation (EU) 2022/2554.

Benefits of penetration testing

Most of the benefits come from a person, not a tool, trying to break in:

1. It shows real risk. Findings are proven, so you know which weaknesses an attacker could actually use.
2. It ranks fixes by impact, so the dangerous issues get fixed first instead of working through a scanner export.
3. It finds what tools miss: access control failures, business logic flaws and chains of low-risk issues that add up to a serious one.
4. It tests your defences. If your security team is not told in advance, a test also shows whether they noticed and responded.
5. It provides independent evidence that customers, auditors, insurers and regulators recognise.
6. It makes the case for investment. A demonstrated attack path is easier for a board to act on than a list of CVE numbers.

What are the limitations of penetration testing?

A penetration test is a snapshot of a defined scope, taken over a limited time, so plan for its limits:

How long does a pen test take and what does it cost?

Both follow scope. A small external test can take under a day of testing, while a multi-scope assessment can take several weeks. Most tests are priced by tester-days, so cost rises with scope; our guide to penetration testing cost gives published price ranges by test type.

As for frequency, once a year and after significant change is the common baseline; our guide on how often you should run a penetration test covers the rules for PCI DSS, ISO 27001 and insurers.

Is penetration testing legal in the UK?

Yes. Penetration testing is legal in the UK when the owner of the systems has authorised it in writing and the tester stays within the agreed scope. Without that permission, the same activity can be a criminal offence under the Computer Misuse Act 1990, which covers accessing computer material without authorisation and unauthorised acts that impair how a computer works.

A lawful test rests on three things:

• Written authorisation from the system owner, naming the targets, dates and testing methods, signed by someone with the authority to give it.
• Permission from third parties where the systems are not wholly yours, such as cloud providers’ testing policies, hosting companies, managed service providers and the landlords of shared premises.
• Staying in scope. Anything outside the agreed targets, such as a supplier’s system reached during the test, needs its own permission first.

Physical tests need extra care, including an authorisation letter the tester carries on site; our guide to physical penetration testing explains what that letter can and cannot do.

Who carries out penetration tests?

Specialist testers, from an internal team or an external provider, working with the written authorisation described above.

For PCI DSS, Requirements 11.4.2 (internal testing) and 11.4.3 (external testing) expect a qualified internal resource or qualified external third party who is organisationally independent of the systems tested, working to the documented methodology that 11.4.1 requires. Beyond that, look for a provider that scopes carefully, tests manually and writes reports your team can act on. Our guide on how to choose a penetration testing company lists the questions to ask.

Why Sovereign Secure

• A PCI SSC Qualified Security Assessor company, also a Qualified PIN Assessor and Card Production Security Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028. We know what evidence an assessor expects from Requirement 11.4 testing.
• ISO 27001 certified, so your data and findings are handled under an independently certified information security management system.
• An IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates.
• Every common test type: web applications, APIs, networks and infrastructure, cloud, mobile apps, hardware and IoT including POS and PIN devices, wireless, social engineering, red team, source code review, AI and LLM applications and firewall review, plus vulnerability scanning.

Next step

If you know what you need tested, our penetration testing quote form turns your scope into a fixed-price proposal. If you are still deciding, see our penetration testing services UK overview, or call +44 161 523 5276.