Penetration test (pen test)
Also called pen test, pentest, ethical hacking.
An authorised, simulated attack on a system by security testers, to find weaknesses that a real attacker could use.
Last updated
What it is.
In a pen test, testers try to get around a system's security the way an attacker would, often using the same tools and chaining small weaknesses into bigger access. NIST's glossary describes it as testing where assessors try to circumvent or defeat a system's security features.
Tests are scoped up front: which apps, APIs and environments, black box or with credentials and source access, and what is off limits. The result is a report of findings ranked by severity, which the team fixes and then has retested.
Why it matters
Code review and scanners miss logic flaws, such as one customer reading another's data by changing an ID. A pen test finds those. Enterprise buyers, SOC 2 auditors and card rules often ask for a recent test, and a clean retest is good evidence in a security review.
In a product build
We give testers a staging copy with realistic data and test accounts for each role, fix findings by severity, and add a test for each one so it cannot come back. Common issue types, like broken access checks, feed into code review checklists.
Common mistakes.
- 01
Testing production without agreement, or with real customer data.
- 02
Scoping only the web front end and leaving the API and admin tools out.
- 03
Filing the report and not scheduling the retest.
Read the official text.
Primary sources this definition is based on.
- NIST CSRC glossary, Penetration testingchecked 2026-10-25
Related terms.
- RBAC (role-based access control)An access model where permissions are attached to roles, and people get access by being given a role.
- Multi-tenancyOne running copy of a software product serving many customers, called tenants, with each tenant's data kept apart.
- SOC 2 Type IIAn independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
- Audit logA record of who did what in a system, when and from where, kept so actions can be traced later.
- Accessibility auditA structured review of a website or app against an accessibility standard, usually WCAG, to find what blocks disabled people from using it.
