Black box
The tester starts with no internal information, like an external attacker. It shows what is reachable from outside, but can take longer to reach the deeper areas.
Guide · Penetration testing · Pentest
Penetration testing: what it is, when you need it and how to read the report
A penetration test simulates an authorized attack against a system to see whether a weakness is really exploitable and what damage it could cause. This guide explains how it works, which types exist, when you need one, what a good report must contain and how to choose a provider.
What a penetration test is, in one sentence
It is an authorized and controlled security test in which a tester tries to exploit the weaknesses of a system, within agreed limits, to demonstrate their real impact and show how to fix them.
The key word is "exploitable". A list of possible problems says that something could go wrong. A penetration test says what can go wrong, how, and with which consequence.
Penetration test and vulnerability assessment: the differences
They are complementary activities that are often confused. The difference lies in the goal, the method and the type of result.
| Aspect | Vulnerability assessment | Penetration test |
|---|---|---|
| Goal | Find and classify vulnerabilities | Verify what is exploitable and its impact |
| Method | Mostly automated, broad | Mostly manual, targeted |
| False positives | Possible, to be verified | Reduced by exploitability checks |
| Typical frequency | Periodic or after each change | Annual or after significant changes |
| Result | Prioritized list | Proof of exploitation and a remediation plan |
Black box, grey box, white box
The type of test depends on how much information and access the tester receives. There is no best type in absolute terms: it depends on the question you need to answer.
Grey box
The tester receives partial information, for example a test account or a map of the functions. It is the most common type for web applications, because it covers the control between users well.
White box
The tester knows the code, the architecture and the configuration. It finds more problems in less time, and it is useful before a major release or for a deep review.
The type must be agreed
The type of test belongs in the scope. If it is not defined, it is hard to tell what the report really covers.
When you need a penetration test
There is no single frequency. There are situations where a test is almost always appropriate, and others where it is already required.
Before launch
A new application or a site handling sensitive data should be tested before going live, when fixing still costs little.
Tenders and specifications
Many bids ask for a documented security verification as a requirement to take part or to perform the contract.
Questionnaires and regulations
For PCI DSS, NIS2, GDPR Art. 32 or ISO/IEC 27001 the test is one of the technical pieces of evidence required, alongside processes.
After major changes
An infrastructure change, a new login system or a payment integration are good reasons to repeat the test.
The phases of a penetration test
A well-run test follows a recognisable path. Each phase must produce an output, otherwise the work cannot be verified.
1. Planning and scope
Objectives, perimeter, type of test, time windows, contacts and rules of engagement are defined, with a signed authorization.
2. Reconnaissance
Hosts, services, technologies, endpoints and application flows are mapped. The more accurate this phase, the more complete the test.
3. Analysis and exploitation
Weaknesses are searched for and their exploitability is verified, in a controlled way, with no destructive actions and no leaving the perimeter.
4. Documentation and retest
The report is written, discussed with the team and, after the fixes, the closure of each vulnerability is verified.
What a good report must contain
If one of these elements is missing, the report is useful neither to the team nor to the client. You can check a report from any provider against this list.
Perimeter and methodology
Systems tested, dates, type of test and declared method, for example OWASP WSTG or PTES.
Reproducible proof
For each vulnerability: reproduction steps, evidence and impact. Anyone reading it must be able to repeat the test.
Risk and priority
Severity, exploitability and real exposure, with a clear and reasoned fix priority.
Remediation plan and retest
Corrective actions with suggested owners, and a final verification that closes the cycle with the status of each vulnerability.
An example of a well-written entry: "Order detail endpoint, identifier parameter. An authenticated user with the customer role can read another customer's order by changing the identifier. Proof: request and response attached. Impact: personal and payment data of other customers. Fix: verify that the order belongs to the user making the request. Retest: confirmed closed."
How to choose a provider
Questions to ask before signing, valid for any provider.
Written authorization
The provider should ask you for a signed authorization before starting the test. If it does not, that is a warning sign.
Scope and rules of engagement
Perimeter, limits and windows must be written down, not left to a verbal agreement.
Methodology and people
Ask which methodology they use and who performs the work, with verifiable references and, where applicable, staff certifications.
Insurance cover
Ask in writing whether professional liability insurance covering the work is in force.
Penetration testing and the law
Accessing an information system without authorization can amount to a crime, such as unlawful access under Article 615-ter of the Italian Criminal Code. That is why the owner's authorization is the first document to sign, and the perimeter must match the one authorized.
The handling of any data encountered during the test must also be agreed: the tester accesses data only to the extent needed to demonstrate an exposure.
How much it costs
The cost depends on the perimeter and the depth of the test, and comparing quotes is only useful when the scope is the same. For an external web domain, our Single perimeter plan costs €490 one-off, VAT excluded. The full price list is on the home page.
Frequently asked questions on penetration testing
Is a penetration test legal?
Only with the written authorization of the system owner. Without authorization, accessing a system can amount to unlawful access under Italian criminal law (Art. 615-ter c.p.).
Does a penetration test slow down the website?
We work within agreed limits and windows defined before we start, to keep the impact on the service to a minimum.
What is the difference from a red team?
A red team simulates an attacker with broader goals and timing, often without warning most staff. A penetration test has a perimeter and rules defined in advance.
How long does the report take?
For an external web domain we deliver the report within 5 working days of the signed authorization.
Does a penetration test find every vulnerability?
No. A test shows what is exploitable within the perimeter, with the access and the time agreed. It does not guarantee the absence of other vulnerabilities, which is why it should be repeated and combined with other controls.
Not sure whether your system needs a penetration test?
Send us one domain: within 24 hours we tell you in writing whether it is needed, on which perimeter and what we would look at.
Read your perimeter for free