A penetration test is a controlled, authorised attempt to break into your systems, carried out by security professionals who think like attackers. The aim is simple: find the weaknesses before someone with bad intentions does.
If you’ve never commissioned one, the process can feel opaque. Here’s what actually happens, step by step.
Step 1: Scoping
Every good test starts with a conversation. What do you want tested, and why? Common scopes include:
- External infrastructure: everything visible from the internet, such as websites, email servers and remote access.
- Internal network: what an attacker could do once inside, for example after a successful phishing email.
- Web applications: customer portals, e-commerce sites and bespoke software.
- Cloud environments: configuration and access across your cloud services.
- Social engineering: testing how people respond to phishing or phone-based attacks.
Scoping also sets the rules: dates, times, systems that are off-limits and who to contact if something unexpected happens.
Step 2: Reconnaissance
Testers gather information, just as a real attacker would. That includes mapping your internet-facing systems, identifying software versions and looking for information that’s been exposed publicly.
Step 3: Testing and exploitation
This is the hands-on part. Testers look for vulnerabilities and, where agreed, attempt to exploit them to show what an attacker could actually achieve. Finding an outdated server is useful. Showing that it leads to your customer database is far more powerful.
Good testers work carefully to avoid disruption, and will stop and tell you straight away if they find something critical.
Step 4: Reporting
The report is what you’re really paying for, so it needs to work for two audiences.
- An executive summary that explains the overall risk in business terms, for leadership and the board.
- Technical findings with clear evidence, a severity rating and practical remediation steps for your IT team.
Step 5: Remediation and retesting
A test is only valuable if you act on it. Prioritise the critical and high-risk findings first, then work through the rest. A retest confirms the fixes have worked, and gives you evidence for auditors, insurers and customers.
How often should you test?
At least once a year, and after any significant change, such as a new application, a major infrastructure update or a move to the cloud. Many organisations combine annual penetration tests with continuous vulnerability scanning in between.
Why accreditation matters
Not all penetration tests are equal. CREST accreditation means the testing company and its testers have been independently assessed against rigorous standards for methodology, ethics and technical skill. It gives you confidence the work will be thorough, safe and properly reported.
How to get the most from your test
A little preparation makes a penetration test far more valuable.
Be clear about your goals. Are you meeting a customer requirement, checking a new application before launch or looking for your biggest weaknesses? The answer shapes the scope.
Share context. Testers can do more in the time available if they understand your environment, recent changes and the systems you’re most worried about.
Tell the right people. Make sure your IT team, managed service provider and any hosting partners know testing is happening, so alerts aren’t mistaken for a real attack.
Plan time for fixes. Book remediation capacity in advance, especially if the test is close to a deadline or change freeze.
Read the report together. Walk through the findings with the testers. It’s the quickest way to understand what matters most and why.
Track remediation. Turn findings into actions with owners and dates, and retest to confirm they’re closed.
One common mistake is testing only what’s comfortable. If a system matters to your business and is reachable by an attacker, it belongs in scope. A test that avoids your most important systems may look good on paper, but it won’t tell you what you really need to know.
Find your weaknesses first
CyberQ’s CREST-accredited Penetration Testing service uncovers the gaps attackers would exploit and gives you a clear, prioritised plan to close them. Talk to our testers about scoping your next test.
