What Is Penetration Testing? Ethical Hacking, Explained

Penetration testing is a controlled, authorized attack on your own systems. A skilled security professional, often called an ethical hacker, attempts to break into your applications, networks, or cloud environment the same way a real attacker would. The goal is simple: find the exploitable weaknesses before someone malicious does, and prove exactly what an attacker could reach.

This guide explains what penetration testing is, how it relates to ethical hacking, how an engagement actually works from scoping to retest, and how to tell whether your organization needs one.

What is penetration testing?

A penetration test (often shortened to pentest) is a time-boxed security engagement with three defining features:

• It is authorized. Testing happens under a written agreement that defines what may be attacked, when, and how. Without that authorization, the same activity would be a crime.
• It is adversarial. Testers do not just look for weaknesses. They actively exploit them, chain them together, and demonstrate real impact, such as reading customer data or taking over an administrator account.
• It ends in evidence. The deliverable is a report: every finding, its severity, proof it is real, and concrete steps to fix it.

The primary goal of penetration testing is to answer one question with evidence instead of assumptions: what could a real attacker actually do to us? A vulnerability scanner can tell you a port is open or a library is outdated. A penetration test tells you that those two facts, combined, let an attacker export your database.

That distinction matters. Automated tools find known issues. Human testers find the things tools cannot see: broken business logic, chained exploits, and permission flaws unique to your application. We compare the two approaches in depth in penetration testing vs vulnerability scanning.

Penetration testing vs ethical hacking: what is the difference?

The two terms overlap, and people often use them interchangeably. The distinction is scope.

Ethical hacking is the broad discipline: using attacker skills and techniques lawfully, with permission, to improve security. It covers penetration testing, red teaming, bug bounty hunting, vulnerability research, and security tool development. An ethical hacker is defined by authorization and intent. Same skills as a criminal hacker, opposite mandate.

Penetration testing is one specific, structured application of ethical hacking. It is a scoped engagement with a defined target list, a fixed time window, rules of engagement, and a formal report at the end.

A useful way to remember it: every penetration tester is an ethical hacker, but not all ethical hacking is a penetration test. When a company says “we need an ethical hacker,” what they usually need is a penetration test.

Two related engagement types sit nearby:

• Red teaming goes further than a pentest. Instead of finding as many vulnerabilities as possible, a red team pursues one objective (like reaching the payment system) while trying to evade detection. We break down the differences in red team vs blue team.
• Bug bounties are open-ended programs where independent researchers report individual bugs for rewards. They complement pentests but do not replace the systematic coverage of one.

Why penetration testing matters

Three forces drive organizations to test:

1. Attackers do not wait. The average cost of a data breach was $4.44 million globally, and $10.22 million for US companies, in IBM’s 2025 research (see our sourced penetration testing statistics), and small companies absorb proportionally worse damage. Finding an exploitable flaw in a report costs a fraction of finding it in an incident.
2. Compliance requires it. PCI DSS and NYDFS 500 mandate penetration testing explicitly. SOC 2, ISO 27001, HIPAA, and CMMC require it in effect, because auditors expect tested evidence that controls work. Our guide to compliance frameworks that require penetration testing covers each one.
3. Customers ask for it. Enterprise procurement and security questionnaires increasingly demand a recent penetration test report before signing. For many SaaS companies, the first pentest happens because a deal depends on it.

How does penetration testing work? The 6 phases

A professional engagement follows a defined process. Ours is aligned to the Penetration Testing Execution Standard (PTES) and OWASP testing guides, and most reputable firms follow a similar arc.

Phase	What happens
1. Scoping	Targets, test accounts, timing, and rules of engagement are agreed in writing. You receive a fixed price and a signed authorization to test.
2. Reconnaissance	Testers map the attack surface: domains, endpoints, technologies, exposed services, and anything an attacker could learn from outside.
3. Scanning and enumeration	Automated tooling and manual probing identify candidate weaknesses across the scoped systems.
4. Exploitation	Testers attempt to exploit the candidates: bypassing authentication, escalating privileges, chaining flaws, and reaching sensitive data.
5. Reporting	Every confirmed finding is written up with severity, evidence, and remediation guidance. Critical issues are reported the day they are found, not weeks later.
6. Retest	After your team fixes the findings, the tester verifies each fix actually closed the hole.

That final phase is worth underlining. A pentest without a retest leaves you with a list of problems and no proof they were solved. Every Invadel penetration test includes a free retest after remediation, because the fix-and-verify loop is the point of the exercise.

For a step-by-step preparation view from the client side, see our penetration testing checklist and how to scope your first penetration test.

What gets tested: the main types

Penetration tests are scoped by target. The most common:

• Web application: the OWASP Top 10, business logic, and access control flaws in your web apps.
• API: REST and GraphQL endpoints, broken object-level authorization, data exposure.
• External network: everything you expose to the internet, tested from an attacker’s position outside.
• Internal network: what an attacker can do after a foothold, such as a phished laptop, inside your network.
• Cloud: AWS, Azure, and GCP misconfigurations, identity and access paths.
• Mobile: iOS and Android apps, insecure storage, and their backend APIs.
• Social engineering: phishing and voice campaigns that test the human layer.

Full breakdown with scoping guidance: types of penetration testing. Testing depth also varies by how much knowledge testers start with, which is the black box vs white box decision. Network scopes get their own deep dives in our network penetration testing guide and external vs internal penetration testing.

What is penetration testing in software testing?

Developers often meet the term in a different context: as a category of software testing, alongside unit tests and QA. The framing fits, with one important difference.

Functional testing asks “does the application do what it should?” Penetration testing asks “can the application be made to do what it should not?” A login form that works perfectly for legitimate users can still be bypassed with a SQL injection. QA verifies intended behavior. A pentest hunts for unintended behavior an attacker could abuse.

In a mature development lifecycle, penetration testing complements the automated security checks that run in CI, such as static analysis and dependency scanning. Automation runs continuously and catches known patterns. A human-led test, typically annual or tied to major releases, catches what automation misses. We cover that division of labor in automated vs manual penetration testing and in our guide to shifting security left in the SDLC.

What does a penetration tester do?

Day to day, a penetration tester:

• Studies the target and builds an attack plan for the scoped systems
• Probes for weaknesses manually and with specialist tooling
• Exploits what they find, carefully, inside the agreed rules of engagement
• Documents every step with screenshots and reproduction detail
• Writes the report and walks the client’s team through the fixes
• Verifies remediation in the retest

The role demands both breadth and judgment. Certifications like OSCP and OSCE mark testers who can actually exploit systems rather than just run scanners. Experience matters more: a senior tester recognizes an exploit chain a junior would walk past. That is why who does your testing matters more than any tool a vendor lists.

The career path draws people from system administration, development, and security operations, usually through hands-on labs and certification tracks. It is one of the most in-demand roles in security, with hundreds of thousands of unfilled positions industry-wide.

Is penetration testing legal?

Yes, with one non-negotiable condition: written authorization from someone empowered to give it. A signed authorization to test converts what would otherwise violate computer-crime laws, such as the US Computer Fraud and Abuse Act, into a lawful engagement. Any professional firm will insist on this paperwork before touching a system, and will require proof that you own, or have permission to test, everything in scope. Cloud providers have their own rules for tests against systems hosted on their platforms, which is part of scoping an AWS test properly.

If a vendor is willing to start without written authorization, that is a red flag about everything else they do.

How often should you test, and what does it cost?

Annually at minimum, plus after significant changes: a major release, a new cloud environment, an acquisition, or an infrastructure migration. Compliance frameworks generally assume this cadence, and PCI DSS states it outright. Between annual tests, continuous scanning covers newly disclosed vulnerabilities. That layered rhythm is the model behind continuous penetration testing and PTaaS.

Cost follows scope. In the US market, most professional engagements land between $4,000 and $15,000 for a defined scope like a web application or external network, with larger estates running higher. Invadel publishes fixed prices across all of its penetration testing services, starting at $4,200 for an external network test, so you know the number before you sign. The full breakdown is in how much does a penetration test cost.

What you get at the end

A penetration test report should function as three documents at once:

1. An executive summary a non-technical leader or auditor can read
2. Technical findings with severity ratings, evidence, and step-by-step remediation
3. Compliance evidence that maps findings to the frameworks your auditors care about

Ask any prospective vendor for a redacted sample before you commit. You can request ours and judge the quality directly.

Frequently asked questions

What is the primary purpose of penetration testing? To find and prove exploitable weaknesses before a real attacker does. The output is evidence: what an attacker could reach, how, and what to fix first.

What is penetration testing in cyber security terms? It is offensive security applied defensively. Authorized professionals simulate real attack techniques against your systems to measure how your defenses hold up in practice, not on paper.

How long does a penetration test take? Most defined-scope engagements run one to three weeks from kickoff to final report. Testing itself typically takes five to ten working days, depending on scope size.

Is penetration testing the same as ethical hacking? Penetration testing is one form of ethical hacking. Ethical hacking is the broader discipline; a pentest is a scoped, structured engagement with a formal report.

Can penetration testing be automated? Parts of it. Scanning and known-vulnerability detection automate well. Exploitation, business-logic abuse, and chained attacks still require human testers, which is why fully automated “pentests” are closer to vulnerability scans.

What is red team penetration testing? A common shorthand for objective-driven testing that also evades detection. Strictly speaking, that is red teaming rather than a standard pentest, and it suits organizations that already test regularly.

The short version

Penetration testing is ethical hacking with a scope, a clock, and a report. It exists because the only honest way to know whether your security holds is to attack it under controlled conditions. Test at least annually, fix what gets found, verify the fixes, and keep the evidence for your auditors and customers.

If you want a number for your environment, scope your assessment and we will return a fixed price within one business day.