Penetration testing basics and methodology
What a penetration test is, the types and process, how to scope one, read the report and manage what it finds.
Penetration Testing Results: How to Read a Pentest Report and Act on It
Penetration testing results explained: decode CVSS, weigh risk vs severity, dispute false positives, plan the retest and know what to send auditors.
Risk-Based Vulnerability Management (RBVM): How to Prioritize What Attackers Will Exploit
Risk-based vulnerability management explained: combine KEV, EPSS, exposure and asset value, borrow the BOD 26-04 deadline model, and copy our tier table.
Threat vs Vulnerability vs Risk: Definitions and Examples
Threat vs vulnerability vs risk: NIST definitions, 8 worked examples, the risk formula, and which assessment measures each. Validated scans from $1,500.
Vulnerability Management Metrics: 15 KPIs That Matter, With Formulas and Targets
Vulnerability management metrics that hold up: 15 KPIs with formulas and starting targets, from MTTR and SLA adherence to KEV exposure and scan coverage.
Vulnerability Management Process: How to Build a Program
The vulnerability management process in seven stages: a policy template, a RACI, a 90-day rollout, framework scan cadences and scans from $1,500.
Vulnerability Assessment Report Template (With Example)
A free vulnerability assessment report template with each section explained, a filled-in example finding, and how a validated report beats raw scanner output.
Vulnerability Remediation: How to Prioritize, Fix and Prove It
A practical vulnerability remediation guide: how to prioritize with KEV, EPSS and exposure, set fix SLAs, run the workflow, and prove the fix with a retest.
How Often Should You Do a Penetration Test? A Frequency Table by Framework
How often to do pen tests: what PCI DSS, SOC 2, HIPAA, ISO 27001, NYDFS 500, and CMMC require, the changes that trigger a retest, and the right cadence.
Penetration Testing vs Vulnerability Scanning: Which One Do You Need?
Penetration testing vs vulnerability scanning vs vulnerability assessment: what each finds, which frameworks require which, what each costs, when you need both.
Manual vs Automated Penetration Testing: What Each One Finds
Manual vs automated penetration testing: what scanners and autonomous pentest tools find, what only a human tester finds, and how to combine the two.
The Benefits of Penetration Testing: What You Actually Get for the Money
The real benefits of penetration testing: what a manual test delivers for security, compliance, sales, insurance, and engineering, and how to get them.
The Penetration Testing Process: Every Phase, Step by Step
Penetration testing process, phase by phase: scoping, reconnaissance, discovery, exploitation, post-exploitation, reporting, and retest, and your part in each.
Penetration Testing Report Template: Every Section, With Examples
Free pentest report template in Word (DOCX) and Markdown: all 10 sections with sample wording, from the executive summary and severity scale to the retest.
Types of Penetration Testing: Every Kind, Explained
The types of penetration testing by target (web, API, mobile, network, cloud, hardware, AI), by method, and by cadence, with fixed prices and how to choose.
How Long Does a Penetration Test Take?
How long a penetration test takes, from scoping to retest: durations by test type, what makes a test run long, and how to plan around an audit deadline.
Network Vulnerability Assessment Checklist: 30 Checks Before, During, and After the Scan
How to run a network vulnerability assessment: scoping, discovery, authenticated scanning, validation, prioritization and reporting, in 30 checks.
The Penetration Testing Execution Standard (PTES), Explained
PTES, the Penetration Testing Execution Standard: what each of its 7 phases requires, how it compares to NIST 800-115 and OWASP, and 6 questions for vendors.
What Is Penetration Testing? Ethical Hacking, Explained
Penetration testing is a controlled, authorized attack on your systems. What pentesting is, how it works in 6 phases, and how it relates to ethical hacking.
Black Box vs White Box vs Gray Box Penetration Testing
What black box, white box, and gray box penetration testing mean, what each finds, misses, and costs, and how to choose the right method.
Vulnerability Assessment and Penetration Testing (VAPT)
VAPT testing explained: what vulnerability assessment and penetration testing each find, when you need both, and what it costs, with scans from $1,500.
Security Between Penetration Tests
An annual pentest covers two weeks and leaves fifty uncovered. Here is how to secure the rest of the year without waiting for the next scheduled engagement.
Offensive vs Defensive Security: What Each Does and Which Comes First
Offensive vs defensive security explained: what each does, how red and blue teams differ, where purple teaming fits, and which to invest in first.
CTEM: Continuous Threat Exposure Management
CTEM is a framework for continuously finding and reducing exposure instead of testing once a year. Here is what its five stages mean and how to put it to work.
Penetration Testing Checklist: From Scoping to Retest
A penetration testing checklist for every stage of a test: scoping, reconnaissance, web application and API checks, exploitation, reporting, and the retest.
Page 1 of 2 · 28 articles
Not looking for an article? See our penetration testing services, compare penetration testing providers, check the US penetration testing price index, or download the free templates and checklists.
