Penetration test

Penetration testing grew out of the "tiger team" exercises commissioned by the US military and government in the late 1960s and 1970s; James P. Anderson's 1972 Computer Security Technology Planning Study for the US Air Force described penetration of systems as a way to demonstrate their weaknesses. Modern practice is codified in methodologies such as NIST SP 800-115 (planning, discovery, attack and reporting phases), the Penetration Testing Execution Standard (PTES), OSSTMM and, for web applications, the OWASP Web Security Testing Guide. A typical engagement moves through reconnaissance, enumeration, vulnerability identification, exploitation, post-exploitation (privilege escalation, lateral movement, access to agreed "flags" such as a file share or a domain admin credential) and reporting.

The legal and contractual frame is not a formality. Testing without authorisation is unlawful access to a computer system; in Denmark that is criminal under section 263(1) of the Penal Code (straffeloven). The rules of engagement therefore fix the scope (IP ranges, hostnames, applications, cloud tenants - and explicit exclusions), the testing window, permitted techniques (is social engineering, denial of service or physical access in scope?), emergency contacts and a stop procedure, handling of any personal data encountered, and written authorisation from someone who actually owns the systems. Cloud and hosting providers have their own policies on testing their platforms, and third-party SaaS is usually out of scope unless the provider consents.

Engagements are classified by the knowledge given to testers: black box (none, emulating an external attacker), grey box (credentials or documentation, often the most efficient use of testing time) and white box (full source code and architecture access). Scope types include external network, internal network (often starting from an "assumed breach" foothold), web and API, mobile, wireless, cloud configuration and social engineering. A red-team exercise differs in objective: it tests detection and response against a stealthy, goal-oriented adversary over weeks, whereas a pentest tries to find as many exploitable weaknesses as possible within a scope. Threat-led penetration testing (TLPT) under the TIBER-EU framework, and mandatory for certain financial entities under DORA Art. 26, is effectively intelligence-led red teaming.

The report is the product: an executive summary, attack narratives showing how findings chain together, each finding with evidence, affected assets, a severity rating (often CVSS with contextual adjustment) and remediation guidance, followed by a retest to confirm fixes. PCI DSS v4.x requirement 11.4 mandates internal and external penetration testing at least annually and after significant changes; CIS Controls v8 Control 18 places pentesting at IG2 and IG3, since it adds most value once basic hygiene is in place. A pentest is a point-in-time sample, not an assurance that no other weaknesses exist.