{"head":{"title":"What Is a Penetration Test? Pen Testing Explained | OceanLab","description":"A penetration test is an authorised, simulated attack on your system to find weaknesses before real attackers do. What it covers, an example and mistakes.","canonical":"https://oceanlab.in/glossary/penetration-test"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"penetration test","path":"/glossary/penetration-test"}],"slug":"penetration-test","term":"Penetration test (pen test)","aka":["pen test","pentest","ethical hacking"],"category":"Identity and security","short":"An authorised, simulated attack on a system by security testers, to find weaknesses that a real attacker could use.","body":[["In a pen test, testers try to get around a system's security the way an attacker would, often using the same tools and chaining small weaknesses into bigger access. NIST's glossary describes it as testing where assessors try to circumvent or defeat a system's security features."],["Tests are scoped up front: which apps, APIs and environments, black box or with credentials and source access, and what is off limits. The result is a report of findings ranked by severity, which the team fixes and then has retested."]],"why":["Code review and scanners miss logic flaws, such as one customer reading another's data by changing an ID. A pen test finds those. Enterprise buyers, ",{"href":"/glossary/soc-2-type-ii","text":"SOC 2"}," auditors and card rules often ask for a recent test, and a clean retest is good evidence in a security review."],"example":["Before launching to banks, a lending platform has its web app and API tested. The testers find that changing a loan ID in an API call returns someone else's application. The fix adds an ownership check in the shared access layer, and the retest confirms it."],"inBuild":["We give testers a staging copy with realistic data and test accounts for each role, fix findings by severity, and add a test for each one so it cannot come back. Common issue types, like broken access checks, feed into code review checklists."],"mistakes":[["Testing production without agreement, or with real customer data."],["Scoping only the web front end and leaving the API and admin tools out."],["Filing the report and not scheduling the retest."]],"related":[{"href":"/glossary/rbac","label":"RBAC (role-based access control)","detail":"An access model where permissions are attached to roles, and people get access by being given a role."},{"href":"/glossary/multi-tenancy","label":"Multi-tenancy","detail":"One running copy of a software product serving many customers, called tenants, with each tenant's data kept apart."},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II","detail":"An independent audit report on whether a service organisation's controls were designed well and worked over a period of time."},{"href":"/glossary/audit-log","label":"Audit log","detail":"A record of who did what in a system, when and from where, kept so actions can be traced later."},{"href":"/glossary/accessibility-audit","label":"Accessibility audit","detail":"A structured review of a website or app against an accessibility standard, usually WCAG, to find what blocks disabled people from using it."}],"tools":[],"links":[{"href":"/compliance/soc-2","label":"SOC 2 guide","detail":"The controls behind a SOC 2 report."}],"sources":[{"title":"NIST CSRC glossary, Penetration testing","url":"https://csrc.nist.gov/glossary/term/penetration_testing","checkedAt":"2026-10-25"}],"legal":false,"updatedAt":"2026-10-25"}