What is a penetration test?

Penetration test: definition

In a penetration test, or pentest for short, security experts put themselves in the shoes of an attacker. Using the same methods and tools, they try to break into a previously defined system—such as a web app, an interface or the company network.

The written engagement is crucial: such a test is only permissible with the explicit permission of the responsible party and a clearly defined scope. Without this basis, the same activity would be a criminal attack. This article does not replace legal advice.

How a penetration test works

A professional pentest follows a fixed process. Guidance is provided, for example, by the guidelines of Germany’s Federal Office for Information Security (BSI) or by the OWASP Web Security Testing Guide.

Depending on how much the testers know in advance, a distinction is made between black-box tests without insider information, gray-box tests with partial information such as a test account, and white-box tests with insight into source code and documentation. Which variant makes sense depends on the goal: a gray-box test often offers a good balance between realism and effort.

• Preparation: define goals, scope, time windows and contacts
• Information gathering about the target system
• Vulnerability analysis using automated and manual methods
• Controlled exploitation of the vulnerabilities found
• Report with risk assessment and recommended actions
• Retest to confirm the vulnerabilities have been effectively closed

Benefits and limits

A pentest shows how vulnerable a system really is—not just in theory. It finds flaws in business logic that automated scanners miss and provides a prioritized list of what should be fixed first. The report also serves as proof for customers, insurers or auditors.

The limits: a pentest is a snapshot. The very next update can open up new gaps. It also only finds what lies within the agreed scope. It is therefore no substitute for secure development or regular patch management.

The quality of the report also matters: it should describe each vulnerability in a traceable way, rank it by severity and name concrete steps for remediation—in terms that both the technical team and management can understand.

When does a penetration test make sense? A real-world example

A pentest makes sense before launching an application that handles sensitive data, after major changes, at regular intervals for critical systems and when customers or insurers require proof. New interfaces to partners or customers are also a good occasion.

An example: before a customer portal containing contract data goes live, a company commissions a gray-box test. The testers find an upload function that allows arbitrary files to be uploaded without any checks. The gap is closed before launch and the fix is confirmed in the retest. Nano Concepts helps secure applications ahead of a test and fixes the vulnerabilities found in the code.