What Is Penetration Testing? A Beginner's Introduction
What Is Penetration Testing and Why Does It Matter?
Section titled “What Is Penetration Testing and Why Does It Matter?”Penetration testing is the authorised simulation of real-world cyberattacks against an organisation’s systems, following structured methodologies defined by NIST SP 800-115, the Penetration Testing Execution Standard (PTES), and the OWASP Testing Guide.
Penetration testing is the practice of simulating real-world cyberattacks against an organisation’s systems, networks, or applications — with written permission — to find security vulnerabilities before malicious attackers do. A penetration tester (also called a pen tester or ethical hacker) thinks like an attacker but works within a legal and professional framework.
Organisations pay for penetration tests because they need someone outside their daily operations to find the weaknesses they cannot see. It is the security equivalent of hiring a professional locksmith to try to break into your building so you can fix the locks before a burglar finds them.
Penetration testing is not the same as running an automated vulnerability scanner. A scanner checks for known issues against a database. A penetration tester goes further — they chain vulnerabilities together, use creative thinking, and attempt to exploit weaknesses in ways that automated tools cannot. The difference matters, and understanding it is important for anyone entering cybersecurity.
Important: Penetration testing must only be performed with explicit, written authorisation from the system owner. Unauthorised testing is illegal in most jurisdictions regardless of intent. This page teaches you what penetration testing is and how it works — not how to test systems without permission.
When I first heard about penetration testing, I thought it was the same as hacking — just legal. After studying it more carefully, I realised how structured and methodical it actually is. Pen testers do not just fire up a tool and start attacking. They follow a defined methodology, document everything meticulously, and spend a significant portion of their time writing reports rather than running exploits. The report is often more valuable to the client than the actual testing, because it tells them exactly what to fix and in what order. That changed my perception of what offensive security looks like as a career. If you are still asking the bigger “why” question — why ethical hacking exists and what it means for career changers — I wrote about that in What Is Ethical Hacking? A Career Changers Guide.
What Do Real-World Penetration Testing Scenarios Look Like?
Section titled “What Do Real-World Penetration Testing Scenarios Look Like?”According to the 2024 Verizon Data Breach Investigations Report (DBIR), over 80% of web application breaches involve exploitation of known vulnerabilities that a structured penetration test would have identified before attackers did.
Organisations invest in penetration testing for specific, practical reasons. These are not theoretical exercises — they address real business risks.
Organisations invest in penetration testing for specific, practical reasons. These are not theoretical exercises — they address real business risks.
| Scenario | Why a Pen Test Matters |
|---|---|
| A hospital launches a new patient portal | Pen testers find SQL injection flaws that could expose patient records before attackers do |
| A bank is required to comply with PCI DSS | The compliance framework mandates regular penetration testing of payment card systems |
| A company suffers a data breach and wants to prevent another | A pen test identifies the specific weaknesses that were exploited and verifies fixes |
| A government agency processes classified information | Australian ISM controls require security assessments including penetration testing |
| A startup is preparing for a SOC 2 audit | Customers and investors want evidence that the company proactively tests its own security |
| A company merges with another and inherits unknown systems | Pen testing reveals vulnerabilities in the acquired company’s infrastructure |
In Australia, the Australian Signals Directorate (ASD) recommends regular security assessments including penetration testing as part of the Information Security Manual (ISM) controls. Organisations handling government data are often required to undergo testing by IRAP-assessed professionals.
How Does Penetration Testing Work?
Section titled “How Does Penetration Testing Work?”The Penetration Testing Execution Standard (PTES) defines a comprehensive methodology that structures penetration tests into repeatable phases — from pre-engagement planning through exploitation to reporting — ensuring consistent, professional results.
Think of penetration testing like a fire drill for your security.
A fire drill does not wait for a real fire. It simulates an emergency under controlled conditions to find weaknesses in the response plan — blocked exits, missing extinguishers, staff who do not know the evacuation route. After the drill, the organisation fixes the gaps before a real emergency exposes them.
Penetration testing works the same way. Instead of waiting for a real attacker, you hire a professional to simulate an attack under controlled conditions. The pen tester finds the gaps — unpatched servers, weak passwords, misconfigured firewalls, vulnerable web applications — and documents them in a report with prioritised recommendations.
The key differences between penetration testing and a real attack:
- Legal authority: Pen testers have written permission defining exactly what they can and cannot test
- Scope: The engagement defines which systems, networks, and applications are in scope
- Rules of engagement: Clear boundaries on testing times, prohibited techniques, and escalation procedures
- Documentation: Every step is recorded for the final report
- Goal: Improve security, not cause damage
Certification objective: CompTIA PenTest+ (PT0-003) and the CEH (Certified Ethical Hacker) exam both test penetration testing methodology and phases extensively. The eJPT (eLearnSecurity Junior Penetration Tester) is a practical, hands-on entry-level certification.
The 5 Phases of a Penetration Test — Step by Step
Section titled “The 5 Phases of a Penetration Test — Step by Step”Every professional penetration test follows a structured methodology, regardless of the specific framework used. The five phases below are common across PTES (Penetration Testing Execution Standard), OWASP, and NIST SP 800-115.
Phase 1: Planning and Reconnaissance
Section titled “Phase 1: Planning and Reconnaissance”Before any testing begins, the pen tester and the client agree on the scope, rules of engagement, and legal documentation.
Planning activities:
- Sign a Statement of Work (SOW) defining what will be tested
- Establish Rules of Engagement (RoE) — testing windows, prohibited actions, emergency contacts
- Obtain written authorisation — the “get out of jail free” letter that proves the testing is legal
- Define scope — which IP ranges, domains, applications, and physical locations are in scope
- Identify goals — what the client wants to learn (e.g., “Can an external attacker access our customer database?”)
Reconnaissance activities:
- Passive reconnaissance: Gathering publicly available information without touching the target. OSINT tools, DNS records, WHOIS lookups, social media profiles, job postings that reveal technologies used.
- Active reconnaissance: Directly interacting with the target. Port scanning with Nmap, DNS enumeration, identifying running services and versions.
Phase 2: Scanning and Enumeration
Section titled “Phase 2: Scanning and Enumeration”With reconnaissance complete, the pen tester actively probes the target to build a detailed map of the attack surface.
Activities:
- Port scanning: Identifying open ports and running services using Nmap
- Vulnerability scanning: Running automated scanners (Nessus, OpenVAS) to identify known vulnerabilities
- Service enumeration: Determining software versions, operating systems, and configurations
- Web application scanning: Using tools like Burp Suite or Nikto to find web vulnerabilities
- Network mapping: Understanding the target’s network architecture, subnets, and trust relationships
The difference between scanning and reconnaissance is directness. Reconnaissance gathers information about the target. Scanning actively probes the target’s systems to find specific weaknesses.
Phase 3: Exploitation
Section titled “Phase 3: Exploitation”This is the phase most people think of when they hear “penetration testing.” The pen tester attempts to exploit the vulnerabilities found during scanning to gain unauthorized access.
Activities:
- Exploiting known vulnerabilities using tools like Metasploit
- Attempting to crack or guess passwords
- Exploiting web application vulnerabilities (SQL injection, XSS, authentication bypass)
- Social engineering attacks (if in scope) — phishing emails, phone calls
- Leveraging misconfigurations — default credentials, excessive permissions, unpatched services
Key principle: A good pen tester does not just prove a vulnerability exists — they demonstrate the real-world impact. “This server is missing a patch” is less compelling than “I exploited this missing patch to gain administrator access to your customer database.”
Phase 4: Post-Exploitation and Lateral Movement
Section titled “Phase 4: Post-Exploitation and Lateral Movement”After gaining initial access, the pen tester determines what the compromised position is actually worth and how far they can go.
Activities:
- Privilege escalation: Moving from a low-privilege user to administrator or root access
- Lateral movement: Using the compromised system to access other systems on the network
- Data exfiltration (simulated): Demonstrating that sensitive data could be extracted
- Persistence: Showing how an attacker could maintain access after the initial exploit
- Pivoting: Using a compromised internal system to reach systems that were not directly accessible from outside
This phase is critical because it demonstrates the real business impact of a vulnerability. A SQL injection that only exposes test data is lower priority than one that leads to full database access.
Phase 5: Reporting
Section titled “Phase 5: Reporting”The report is the most important deliverable of a penetration test. Many experienced pen testers say that report writing takes as much time as the actual testing.
A professional pen test report includes:
- Executive summary: Non-technical overview for management. Risk level, business impact, key findings.
- Methodology: What was tested, how it was tested, tools used.
- Findings: Each vulnerability described with severity rating (Critical, High, Medium, Low), evidence (screenshots, logs), and steps to reproduce.
- Remediation recommendations: Specific, actionable fixes for each finding, prioritised by risk.
- Appendices: Raw scan output, detailed technical evidence, scope documentation.
The 5 Pen Testing Phases
Section titled “The 5 Pen Testing Phases”📊 Visual Explanation
Section titled “📊 Visual Explanation”The 5 Phases of a Penetration Test
A structured methodology from planning through reporting — every professional pen test follows these phases
Types of Penetration Testing
Section titled “Types of Penetration Testing”Not all pen tests are the same. The type determines how much information the tester starts with, which fundamentally changes the approach.
Black Box Testing
Section titled “Black Box Testing”The pen tester receives no prior information about the target — no network diagrams, no source code, no credentials. They start from the same position as a real external attacker.
Advantages: Most realistic simulation of an external attack. Tests the organisation’s external defenses as a real attacker would encounter them.
Disadvantages: Takes longer and costs more. May miss internal vulnerabilities that an insider or compromised account could exploit. Limited time means the tester may not discover everything.
White Box Testing
Section titled “White Box Testing”The pen tester receives full information — network diagrams, source code, credentials, system architecture documentation. Also called “crystal box” or “clear box” testing.
Advantages: Most thorough testing possible. The tester can find deeper vulnerabilities including code-level flaws. More efficient use of testing time.
Disadvantages: Less realistic as an external attack simulation. Does not test the organisation’s ability to detect reconnaissance.
Grey Box Testing
Section titled “Grey Box Testing”The pen tester receives partial information — typically credentials for a standard user account, or basic network information. This simulates an insider threat or an attacker who has already compromised one account.
Advantages: Balances realism with thoroughness. Tests what damage an attacker could do with limited initial access. Commonly used for web application testing.
Disadvantages: May miss external attack vectors that black box testing would find.
Other Pen Test Types by Target
Section titled “Other Pen Test Types by Target”| Type | Target | Focus |
|---|---|---|
| Network pen test | Internal and external networks | Firewalls, routers, switches, segmentation |
| Web application pen test | Websites and web apps | OWASP Top 10 vulnerabilities, authentication, authorisation |
| Wireless pen test | Wi-Fi networks | Encryption weaknesses, rogue access points, WPA cracking |
| Social engineering test | People and processes | Phishing emails, phone pretexting, physical access |
| Physical pen test | Buildings and facilities | Tailgating, lock picking, badge cloning, dumpster diving |
| Cloud pen test | AWS, Azure, GCP environments | IAM misconfigurations, storage exposure, API security |
Penetration Testing vs Vulnerability Scanning
Section titled “Penetration Testing vs Vulnerability Scanning”This is one of the most common misconceptions in cybersecurity. Pen testing and vulnerability scanning are related but fundamentally different activities.
Pen Testing vs Vulnerability Scanning
Section titled “Pen Testing vs Vulnerability Scanning”📊 Visual Explanation
Section titled “📊 Visual Explanation”Penetration Testing vs Vulnerability Scanning
- Manual and creative — Tester chains vulnerabilities and uses judgment
- Proves real-world impact — Demonstrates what an attacker could actually do
- Tests defenses holistically — Includes social engineering, physical, and logical attacks
- Expensive — Requires skilled professionals, typically $5,000–$100,000+ per engagement
- Time-consuming — Takes days to weeks depending on scope
- Point-in-time assessment — Results reflect the state at testing time only
- Fast and automated — Scans thousands of systems in hours
- Affordable — Many open-source options (OpenVAS, Nessus Essentials)
- Repeatable — Can run weekly or daily for continuous monitoring
- High false positive rate — Reports issues that may not be exploitable
- Cannot chain vulnerabilities — Misses complex attack paths that require human creativity
- Checks against known databases — Only finds vulnerabilities in its signature database
The key difference: A vulnerability scanner tells you “this server might be vulnerable to CVE-2024-1234.” A pen tester tells you “I exploited CVE-2024-1234 to gain root access to your database server, extracted 10,000 customer records, and used that server to pivot into your payment processing system.”
Common Penetration Testing Tools
Section titled “Common Penetration Testing Tools”Pen testers use a combination of automated tools and manual techniques. Here are the tools you will encounter most frequently as a beginner.
| Tool | Purpose | Phase Used | License |
|---|---|---|---|
| Nmap | Network discovery and port scanning | Scanning | Open source |
| Burp Suite | Web application security testing | Scanning, Exploitation | Community (free) / Professional (paid) |
| Metasploit | Exploitation framework | Exploitation | Community (free) / Pro (paid) |
| Wireshark | Packet capture and analysis | Reconnaissance, Scanning | Open source |
| John the Ripper | Password cracking | Exploitation | Open source |
| Hashcat | GPU-accelerated password cracking | Exploitation | Open source |
| sqlmap | Automated SQL injection | Exploitation | Open source |
| Nikto | Web server vulnerability scanner | Scanning | Open source |
| Gobuster / Dirb | Directory and file brute-forcing | Scanning | Open source |
| Hydra | Online password brute-forcing | Exploitation | Open source |
Kali Linux is the most popular operating system for penetration testing. It comes pre-installed with hundreds of security tools and is available as a free download. Most pen testing training and certifications assume you are using Kali.
# Example: Basic Nmap scan to discover open ports (Phase 2 - Scanning)# ONLY run this against systems you have written permission to testnmap -sV -sC -oN scan_results.txt 192.168.1.0/24
# -sV: Detect service versions# -sC: Run default scripts# -oN: Save output to file (essential for reporting)# Example: Using Gobuster to find hidden directories on a web server# ONLY run this against systems you have written permission to testgobuster dir -u http://target.example.com -w /usr/share/wordlists/dirb/common.txt -o dirs.txt
# dir: Directory brute-force mode# -u: Target URL# -w: Wordlist file# -o: Output file# Example: Using sqlmap to test for SQL injection# ONLY run this against systems you have written permission to testsqlmap -u "http://target.example.com/page?id=1" --batch --output-dir=./sqlmap_output
# -u: Target URL with parameter# --batch: Use default answers (non-interactive)# --output-dir: Save results for reportingScope, Rules of Engagement, and Legal Agreements
Section titled “Scope, Rules of Engagement, and Legal Agreements”The legal and administrative framework around a penetration test is just as important as the technical work. Without proper documentation, a pen tester is indistinguishable from an attacker in the eyes of the law.
Essential Documents
Section titled “Essential Documents”Statement of Work (SOW): A formal contract that defines what will be tested, the timeline, the deliverables, and the cost. It is a business agreement between the pen testing firm and the client.
Rules of Engagement (RoE): A technical document that specifies:
- Which systems, networks, and IP ranges are in scope
- Which systems are explicitly out of scope (production databases, specific servers)
- Permitted testing hours (e.g., only between 10 PM and 6 AM)
- Prohibited techniques (e.g., no denial of service, no social engineering)
- Emergency contact procedures (who to call if something breaks)
- Data handling requirements (how test data and findings will be stored and destroyed)
Authorisation Letter: Written permission from someone with legal authority to approve the testing. This is your proof that the testing is authorised. Carry a copy during any physical or on-site testing.
Non-Disclosure Agreement (NDA): The pen testing firm agrees to keep all findings, data, and client information confidential.
Legal Considerations
Section titled “Legal Considerations”- Computer Fraud and Abuse Act (CFAA) in the US makes unauthorized access to computer systems a federal crime
- Criminal Code Act 1995 (Cth) in Australia includes offenses for unauthorized access to, modification of, or impairment of data in computer systems
- Written authorisation is not optional — it is the legal boundary between a pen test and a crime
- Scope creep can be criminal — testing systems outside the agreed scope, even accidentally, can have legal consequences
- International engagements may involve multiple jurisdictions with different laws
Penetration testing sits at a later stage of the learning path, and it helps to know exactly where you are relative to it. This tracker maps the full journey from fundamentals through to pen testing readiness.
Career Roadmap & Study TrackerAvailable Now
Step-by-step roadmap with study tracker worksheets and certification decision framework.
What Are the Limitations of Penetration Testing?
Section titled “What Are the Limitations of Penetration Testing?”NIST SP 800-115 acknowledges that penetration testing is inherently a point-in-time assessment — it reflects the security posture at the moment of testing, meaning new vulnerabilities introduced after the engagement are not covered.
Penetration testing is valuable but not perfect. Understanding its limitations makes you a more informed security professional.
Pen testing is a point-in-time assessment. A pen test tells you what was vulnerable at the time of testing. A new vulnerability could be introduced the next day through a software update, configuration change, or new system deployment.
Scope limits what you find. If the client excludes their most critical systems from scope, the pen test cannot assess the organisation’s actual risk posture. Some organisations intentionally limit scope to reduce cost, which reduces the value of the test.
Skill varies between testers. Two pen testers testing the same system may find different vulnerabilities. The quality of the test depends heavily on the tester’s experience, creativity, and thoroughness.
Time constraints are real. A one-week pen test cannot cover the same ground as a real attacker who has months of persistence. Professional pen tests are always a compromise between thoroughness and budget.
False sense of security. A clean pen test report does not mean an organisation is secure — it means the specific tester did not find exploitable vulnerabilities during the specific testing window with the specific scope. This distinction matters.
Social engineering resistance. If social engineering is not in scope, the pen test does not measure the organisation’s biggest attack surface: its people.
What Interview Questions Should You Expect About Penetration Testing?
Section titled “What Interview Questions Should You Expect About Penetration Testing?”Penetration testing methodology is a core topic in entry-level cybersecurity interviews because it tests your understanding of offensive security — even for defensive roles like SOC analyst, as documented in the CompTIA PenTest+ PT0-003 and Security+ SY0-701 exam objectives.
Pen testing questions come up even in non-pen-testing interviews because they test your understanding of offensive security concepts.
| Question | What They Are Testing | Strong Answer Approach | Weak Answer |
|---|---|---|---|
| What are the phases of a penetration test? | Whether you understand the structured methodology | Name all five phases and briefly explain each. Emphasise that planning and reporting are as important as exploitation. | ”Scanning and hacking” (missing critical phases) |
| What is the difference between a pen test and a vulnerability scan? | Whether you understand the distinction | ”A vulnerability scan is automated and identifies known issues. A pen test is manual, exploits vulnerabilities to prove impact, and chains findings into realistic attack paths." | "They are basically the same thing” |
| What would you do if you found a critical vulnerability during a pen test? | Process awareness and professionalism | ”Document it immediately, assess the business impact, and notify the client through the agreed emergency contact procedure before continuing testing." | "Exploit it as far as possible” |
| Is it legal to pen test a system without permission? | Ethical and legal awareness | ”No. Unauthorized testing is illegal under laws like the CFAA (US) and the Criminal Code Act 1995 (Australia). Written authorisation from the system owner is mandatory before any testing." | "It depends” or “If you are helping them it should be fine” |
| What is the most important phase of a pen test? | Understanding of the full methodology | ”Reporting. The report is the client’s primary deliverable — it turns technical findings into actionable business decisions. Without a clear report, the testing has limited value." | "Exploitation, because that is where you find the vulnerabilities” |
How Is Penetration Testing Used in Real Security Operations?
Section titled “How Is Penetration Testing Used in Real Security Operations?”The OWASP Testing Guide and PTES both emphasise that penetration testing is not an isolated activity — it integrates into an organisation’s broader security operations through remediation tracking, purple team exercises, and compliance validation.
If you are starting as a SOC analyst or junior security professional, understanding pen testing helps you even if you are not performing pen tests yourself.
Reading pen test reports: Many organisations receive annual pen test reports. As a junior security professional, you may be tasked with helping remediate the findings — patching systems, updating configurations, or implementing new controls identified in the report.
Working with pen testing teams: During an active pen test, the SOC team may need to monitor for the pen tester’s activity and distinguish it from real attacks. Understanding the phases helps you anticipate what the pen tester is doing and when.
Defensive perspective: Understanding how pen testers think helps you build better defenses. If you know that pen testers look for default credentials, excessive permissions, and unpatched services, you can prioritise fixing those issues proactively.
Purple teaming: In mature organisations, blue team (defensive) and red team (offensive) work together in “purple team” exercises. Understanding both sides makes you more effective in these collaborative security assessments.
Australian context: Australian organisations subject to the ISM or working toward IRAP assessment often engage pen testing firms that are familiar with ASD’s security controls. If you work in government or defence-adjacent roles in Australia, understanding how pen tests align with ISM control assessments is valuable. CyberCX, Tesserent, and Penten are among the major Australian pen testing firms.
Pen Testing Career Path
Section titled “Pen Testing Career Path”The career path from beginner to professional pen tester is longer than many people expect, but it is achievable.
| Level | Role | Certifications | Typical Experience | Salary Range (US) |
|---|---|---|---|---|
| Entry | Junior Pen Tester / Security Analyst | eJPT, Security+ | 0-2 years (often from SOC or IT first) | $60,000 – $85,000 |
| Mid | Penetration Tester | OSCP, PenTest+, CEH | 2-5 years | $85,000 – $130,000 |
| Senior | Senior Pen Tester / Red Team Lead | OSCP, OSCE3, GXPN | 5-8 years | $130,000 – $180,000 |
| Expert | Principal Consultant / Practice Lead | OSCP + specialised certs | 8+ years | $180,000 – $250,000+ |
Salary data from CyberSeek and PayScale as of 2026. Individual results vary based on location, employer, and negotiation.
Realistic path for career changers:
- Build a security foundation (Security+, networking, Linux)
- Gain 1-2 years of experience in a SOC, IT security, or GRC role
- Study for eJPT while working — it is a practical, hands-on exam
- Practice on platforms like TryHackMe, HackTheBox, and PortSwigger Web Security Academy
- Transition to a junior pen testing role or apply for internal red team positions
- Work toward OSCP when you have solid hands-on experience
Summary and Key Takeaways
Section titled “Summary and Key Takeaways”Penetration testing is structured, methodical, and professional — not the chaotic “hacking” that movies portray.
- Penetration testing is a controlled, authorised simulation of real-world attacks, performed with written permission and defined scope. Without authorisation, it is a crime.
- The 5 phases are: Planning and Reconnaissance, Scanning and Enumeration, Exploitation, Post-Exploitation, and Reporting. All five phases are equally important.
- Three test types define the tester’s starting knowledge: black box (no information), white box (full information), and grey box (partial information).
- Pen testing is not vulnerability scanning. Scanning is automated and identifies known issues. Pen testing is manual, creative, and proves real-world impact by exploiting vulnerabilities.
- The report is the most valuable deliverable. It translates technical findings into business decisions with prioritised remediation recommendations.
- Legal documentation is mandatory. The Statement of Work, Rules of Engagement, and written authorisation letter are not optional paperwork — they are the legal boundary between professional testing and criminal activity.
- Career entry is achievable but takes time. Most pen testers build a security foundation first (1-2 years in SOC or IT security), then transition through certifications like eJPT and OSCP.
Related
Section titled “Related”- Career Paths for the full landscape of cybersecurity roles including pen testing
- Nmap Guide for the most important scanning tool in a pen tester’s toolkit
- Vulnerability Analysis for understanding how vulnerabilities are identified and assessed
- Footprinting for the reconnaissance techniques used in Phase 1
- Scanning Networks for deeper coverage of Phase 2 techniques
Frequently Asked Questions
What is penetration testing in simple terms?
Penetration testing is when an organisation hires a security professional to try to break into their systems — with written permission — to find vulnerabilities before real attackers do. The pen tester follows a structured methodology, documents everything, and delivers a report with findings and recommendations for fixing the issues.
Is penetration testing legal?
Penetration testing is legal only when you have explicit, written authorisation from the system owner. Without authorisation, it is illegal under laws like the Computer Fraud and Abuse Act (US) and the Criminal Code Act 1995 (Australia). The authorisation letter, Statement of Work, and Rules of Engagement are mandatory legal documents.
What is the difference between penetration testing and ethical hacking?
The terms are often used interchangeably, but penetration testing is more structured and formal. A pen test follows a defined scope, methodology, and reporting format as a professional service engagement. Ethical hacking is a broader term that includes pen testing but also covers activities like bug bounty hunting and security research.
What certifications do I need to become a penetration tester?
Start with CompTIA Security+ for the foundation, then the eJPT (eLearnSecurity Junior Penetration Tester) for your first hands-on pen testing certification. The OSCP (Offensive Security Certified Professional) is the industry-standard mid-career certification. CompTIA PenTest+ and the CEH are also widely recognised.
Can I become a penetration tester without IT experience?
It is possible but difficult. Most professional pen testers have 1 to 3 years of prior security or IT experience. The recommended path for career changers is to build a security foundation, gain experience in a SOC or IT security role, then transition to pen testing. Direct entry through intensive self-study and platforms like HackTheBox is the exception, not the rule.
What is the difference between black box, white box, and grey box testing?
Black box: the tester receives no information about the target, simulating an external attacker. White box: the tester receives full information including source code and credentials, allowing the deepest testing. Grey box: the tester receives partial information like a standard user account, simulating an insider threat or a compromised credential scenario.
How much does a penetration test cost?
Costs vary widely depending on scope. A small web application pen test might cost $5,000 to $15,000. A comprehensive network and application pen test for a mid-sized organisation typically costs $20,000 to $50,000. Enterprise-scale engagements with multiple locations and systems can exceed $100,000. These are approximate ranges as of 2026.
What tools do penetration testers use?
Common tools include Nmap (network scanning), Burp Suite (web application testing), Metasploit (exploitation framework), Wireshark (packet analysis), John the Ripper and Hashcat (password cracking), and sqlmap (SQL injection). Most pen testers use Kali Linux, which comes pre-installed with hundreds of security tools.
How long does a penetration test take?
A typical penetration test takes 1 to 3 weeks depending on scope. Small web application tests might take 3 to 5 days. Comprehensive network assessments take 1 to 2 weeks. The final report usually takes an additional 1 to 2 weeks after testing completes. Planning and scoping add time before testing begins.
What is the most important skill for a penetration tester?
Report writing and communication. This surprises many beginners, but the ability to clearly explain technical findings to both technical and non-technical audiences is what separates good pen testers from average ones. Technical skills like networking, scripting, and tool proficiency are also essential, but the report is the client's primary deliverable.
More resources
The open standard that defines the methodology and phases of professional penetration testing.
OWASP Testing GuideThe most comprehensive open-source guide to web application penetration testing, maintained by OWASP.
NIST SP 800-115 — Technical Guide to Information Security TestingNIST's official guide to security testing including penetration testing methodology and planning.
Penetration testing methodologies and tools evolve. Verify current best practices against PTES, OWASP, and NIST SP 800-115. Always obtain written authorisation before testing any system. Salary data from CyberSeek and PayScale as of 2026. Individual results vary.