In short. Penetration testing is a controlled, authorised attempt to break into your systems by a qualified tester, so you find the weaknesses before an attacker does. Unlike a vulnerability scan, it chains flaws together the way a real attacker would and reports what they could reach, how serious it is and how to fix it.
Penetration testing is a controlled, authorised attempt to break into your systems, carried out by a qualified tester so that you find the weaknesses before an attacker does. It is not a vulnerability scan. A scan lists known software flaws; a penetration test chains flaws, misconfigurations and design mistakes together the way a real attacker would, and tells you what they could actually reach. The output is a report that says what was found, how serious it is, what it would let an attacker do, and how to fix it.
This guide covers what a penetration test is, why UK organisations commission one, how it differs from a vulnerability assessment, the types of test, what the process looks like from scoping to retest, and what to expect in the report.
Why organisations commission a penetration test
The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the previous twelve months, rising to 65% of medium and 69% of large businesses. Most of those attacks were not sophisticated. They worked because something was exposed, unpatched, misconfigured or protected by a password that had been used elsewhere. A penetration test finds those things while you still have time to fix them.
There are three practical reasons organisations book one:
- To reduce the chance of a breach. You get a prioritised list of what an attacker could do today, with the fixes, rather than a theoretical list of everything that might be wrong.
- To meet a requirement. PCI DSS requires internal and external penetration testing at least every twelve months and after significant change (requirements 11.4.2 and 11.4.3). Regulated sectors including financial services, health and critical national infrastructure have testing expectations of their own, and many public sector and supply chain contracts ask for evidence of recent testing.
- To win and keep business. Customers increasingly ask suppliers whether they have had a recent penetration test, whether they can see the results and what was fixed. A current report, and a retest showing the fixes worked, answers all three.
Penetration testing vs vulnerability assessment
A vulnerability assessment is an automated scan. It compares what it can see on your systems against a database of known weaknesses and produces a list. It is quick, cheap and worth running regularly. It is also limited to what the scanner recognises, it produces false positives, and it cannot tell you whether two low-rated issues combine into a serious one.
A penetration test is performed by a person. The tester uses scanners as one tool among many, then investigates, validates and exploits what they find, moves through the environment as an attacker would, and judges the real-world impact. A scan might tell you a login page is missing a security header. A penetration test tells you that the missing header, combined with a predictable password reset and an overly permissive role, gets an attacker into the finance director’s account.
Both have a place. A scan every month and a penetration test every year is a reasonable baseline for most organisations. Neither is a substitute for the other.
Types of penetration test
The type of test is defined by what is in scope. We test the following, each described on its own page:
- Web application penetration testing: customer portals, internal systems, SaaS products and e-commerce.
- API penetration testing: REST, GraphQL and SOAP services, on their own or alongside the application that uses them.
- Mobile application penetration testing: iOS and Android, with or without source code.
- External infrastructure penetration testing: everything you expose to the internet.
- Internal infrastructure penetration testing: what an attacker or a rogue insider could do once inside your network.
- Cloud penetration testing: AWS, Azure and Google Cloud configuration and identity.
- Wireless penetration testing: corporate, guest and rogue Wi-Fi.
- Physical penetration testing: covert and overt attempts to get into your premises.
- Build and configuration reviews: Windows, Unix and macOS hardening against a defined standard.
- Penetration testing alongside Cyber Essentials Plus: when you need both, scoped together.
Tests are also described by how much the tester is told. In a black-box test the tester starts with no more than an attacker would have. In a white-box test they have credentials, documentation or source code. Grey-box sits between. White-box testing finds more in the time available because none of it is spent guessing; black-box testing shows you what an outsider can do. Which is right depends on the question you are trying to answer, and it is one of the things scoping settles.
How a penetration test works
- Scoping. An active penetration tester with the relevant skill set agrees the scope with you: what is in, what is out, what you are worried about and what the test is for. You get a fixed quote based on that scope. This is the step that decides whether the test is any use, which is why we do not let sales staff do it.
- Rules of engagement. Dates, contacts, exclusions, testing windows and what happens if something serious is found are agreed on the scoping call and confirmed in writing before anything starts. Authorisation from the system owner is a legal requirement, not a formality.
- Testing. The named consultant who scoped the work delivers it. Critical and high-risk findings are verified and reported to you immediately rather than held back for the report.
- Reporting. Our report is delivered within 5 working days as standard. It contains an executive summary in plain English, a technical summary, and for every finding the observation, its impact, the affected hosts and the remediation. We report everything we find.
- Remediation and retest. You fix the issues. We then retest to confirm the fixes worked and that they have not introduced anything new. One day of retesting is included free for every five days of consultancy, taken within 90 days of the report.
A typical engagement is five to twenty days of testing. A single application or a small external estate can be shorter; a multi-phase programme across several environments can be longer. You can read the process in more detail on our how we test page.
What a good report looks like
The report is the product. If it cannot be understood by the people who have to act on it, the test has failed regardless of what was found. A good report separates the executive view from the technical detail, rates every finding by real impact rather than scanner score, explains how each issue was found so that it can be reproduced, and gives a remediation that a competent administrator or developer can carry out. It should also record what was tested and what was not, so that nobody later assumes coverage that was never in scope.
Rather than describe ours, we publish it. Our sample penetration test report is a full worked example against a fictional company, with one finding at each severity and the retest states shown. It is ungated.
Who does the testing
Ask who will do the work before you sign. The tester should be a named individual with a verifiable qualification: a UK Cyber Security Council professional title in Security Testing, or a CREST or Cyber Scheme certification. Our consultants hold those titles and qualifications and are listed on the team page. Developing testers work as part of a team under a signed-off consultant and never work unsupervised on client engagements. If you want to understand the qualifications, our guide to CREST, The Cyber Scheme and CHECK explains them.
Frequently asked questions
How often should we have a penetration test?
At least annually, and after any significant change: a new application or major release, a migration to the cloud, a merger, a new office or new remote access arrangements. PCI DSS sets twelve months as the maximum interval for cardholder environments and most frameworks follow the same rhythm.
How long does a penetration test take?
Most engagements run five to twenty days of testing, with the report delivered within 5 working days of the end of testing. Small, single-target tests can be a few days; large multi-environment programmes can be longer.
Will a penetration test disrupt our systems?
It should not. Testing is scoped to avoid disruptive techniques unless you specifically want them, testing windows are agreed in advance, and anything that could affect availability is discussed with you before it is attempted.
Is penetration testing legal?
Yes, with written authorisation from the owner of the systems being tested. Without that authorisation it is an offence under the Computer Misuse Act 1990, which is why the rules of engagement are signed before testing begins.
What is the difference between a penetration test and a red team exercise?
A penetration test aims to find as many exploitable weaknesses as possible within a defined scope. A red team exercise aims to achieve a specific objective, such as reaching a particular system, while avoiding detection, and tests your people and monitoring as much as your technology. Most organisations need penetration testing first.
How much does a penetration test cost?
It depends on scope: the number of applications, hosts or locations, the depth of testing and whether credentials are provided. Because we scope with an active tester rather than a sales estimate, the quote is fixed once the scope is agreed. Contact us with what you need tested and we will scope it with you.