Penetration Testing: What to Expect and How to Prepare
Key takeaway
A penetration test is a time-boxed, manual attempt to exploit your systems — not an automated scan. Fix the issues a free scanner would find before the test starts, or you'll pay specialist rates for a list of missing security headers instead of the logic flaws only a human finds.
Penetration tests are usually bought under pressure — a customer's security review, an insurer, or an auditor. Buying one well is mostly about scoping it properly and doing the cheap work first.
Scan, test, and red team are different things
- Vulnerability scan — automated, cheap, finds known issues and misconfigurations. Should be running continuously.
- Penetration test — a skilled human attempts to exploit and chain weaknesses within an agreed scope and window. Finds business logic flaws and privilege escalation that no scanner detects.
- Red team — goal-driven simulation of a real adversary, including social engineering, testing detection and response as much as the technology. Appropriate once your defences are mature.
Scoping decisions that matter
- Black box (no information) is realistic but burns days on reconnaissance. Grey box — credentials and documentation supplied — usually finds more per pound spent.
- Include every user role. Privilege escalation between roles is among the most common serious findings.
- Decide whether the API is in scope separately from the web interface; the API often has weaker authorisation.
- Agree rules of engagement: test environment or production, testing hours, denial-of-service exclusions, and an emergency contact.
Prepare so you're paying for expertise
- Run a free scanner first and fix what it finds — headers, outdated components, exposed admin paths.
- Provide working credentials for every role, and check them the day testing starts.
- Ensure the test environment mirrors production, with realistic data volumes and no debug endpoints that don't exist in production.
- Warn your own monitoring team, or you'll spend the week responding to your own testers.
What you get, and what to do with it
Expect an executive summary, findings rated by severity with evidence and reproduction steps, and remediation advice. Agree a remediation window and a retest — a report without a retest proves only that you had problems. Ask for the retest to be included in the original quote; it's much cheaper than commissioning it later.
Treat the findings as a sample rather than a complete list. A test proves what was found in the days available, not that nothing else exists.