A penetration test is a controlled attack on your systems by authorised experts using the methods a real attacker would use, followed by a report of the findings. The goal is to find and fix weaknesses before malicious actors do.
How is it different from vulnerability scanning?
Vulnerability scanning uses automated tools to detect known weaknesses; it is fast and should be done regularly. A penetration test uses human expertise to show whether those weaknesses can really be exploited and how far an attacker could get by chaining them. The two complement each other.
Types of tests
- External network test: Internet-facing servers, VPN and firewalls.
- Internal network test: What an attacker inside the network, or a malicious insider, could do.
- Web application test: Websites, customer portals and APIs (covering OWASP Top 10 risks).
- Mobile app test: iOS and Android apps and their back-end services.
- Social engineering test: Phishing simulations and physical access attempts.
When should you test?
- Before launching a new web application, customer portal or online shop,
- After major infrastructure changes (cloud migration, new network design),
- When customers, partners or industry regulations require it (for example payment systems),
- And as a general rule at least once a year.
How to plan a good test
- Scope and rules of engagement: Which systems, at what times, which methods are off-limits? Written authorisation and a contract are essential.
- Approach: Choose black box (no information), grey box or white box testing.
- Report: Findings should be prioritised by risk, with reproduction steps and remediation advice for each.
- Fix and retest: Vulnerabilities should be retested after remediation.
Getting the most out of the report
Treat the report as an improvement plan, not an archive document. Assign owners and dates to critical findings and fix the root causes of recurring issues, such as a missing patch process or weak development practices.
ujans provides end-to-end support with vulnerability scanning, penetration test coordination and remediation as part of our security assessments.