A penetration test is a controlled security attack on your systems—executed by professionals with your permission—to find weaknesses before real attackers do. Unlike passive vulnerability scanning, a proper pen test involves active exploitation attempts and realistic threat simulation. Understanding what's included in a professional scope helps you evaluate whether you're getting real security assurance or just a checkbox audit.
The Reconnaissance Phase
Professional pen testers start by gathering intelligence about your organization, systems, and infrastructure. This includes open-source research (public-facing websites, DNS records, LinkedIn profiles of employees), network mapping, and identifying live services. This phase typically takes 5–15% of the overall engagement timeline and informs the rest of the test.
Testers look for information leakage—accidentally exposed API keys, cloud storage buckets, GitHub repositories, or cached credentials. A competent tester won't skip this because external reconnaissance often reveals the path of least resistance into your network.
Scanning and Enumeration
After reconnaissance, testers use automated tools to scan your systems for open ports, running services, and known vulnerabilities. Common tools include Nessus, OpenVAS, Shodan, and Burp Suite. This stage typically accounts for 10–20% of engagement time.
However, this is not just running a vulnerability scanner and dumping results. A professional pen tester analyzes scan output, filters out false positives, and prioritizes findings by business context. A 500-vulnerability report is useless without judgment about severity and exploitability.
Exploitation and Validation
This is where the test earns its value. Testers actively attempt to compromise systems using the vulnerabilities they've identified. Real exploitation proves a flaw isn't just theoretically possible—it's actually exploitable in your environment.
Common exploitation scenarios include:
- Web application testing: SQL injection, cross-site scripting (XSS), authentication bypass, insecure direct object references
- Network compromise: Credential harvesting, lateral movement, privilege escalation
- Social engineering: Phishing campaigns, pretexting, physical security testing (if in scope)
- Cloud infrastructure: Misconfigured S3 buckets, overpermissioned IAM roles, exposed APIs
- Wireless networks: WPA2/WPA3 cracking, rogue access point deployment
Exploitation typically consumes 30–50% of engagement time because it requires manual skill and judgment.
Post-Exploitation and Impact Assessment
Once inside, testers determine what an attacker could actually access or modify—production databases, customer data, intellectual property, system configurations. This step separates a junior report from a mature one. You need to understand not just that a vulnerability exists, but what business impact it poses.
A tester might demonstrate data exfiltration, ransomware simulation, or business-logic attacks (e.g., modifying transaction amounts in a payment system). This validates that your incident response and monitoring capabilities can actually detect and stop attacks.
Remediation and Reporting
The final deliverable is a detailed report documenting every finding with:
- Risk rating (critical, high, medium, low)
- Clear reproduction steps
- Business impact description
- Specific remediation recommendations with vendor guidance or code examples
- Timeline for re-testing
Quality reports run 40–80 pages for a comprehensive test and include executive summaries for non-technical stakeholders. Many firms offer a post-test remediation call to clarify findings and answer questions.
Engagement Variables That Affect Scope
Professional penetration tests vary significantly in depth and cost. Your scope typically depends on:
- Organization size: Startups ($3,000–$8,000 for a targeted test) vs. enterprises ($25,000–$100,000+ for comprehensive assessments)
- Test type: External-only (cheaper, faster) vs. internal (requires network access, more thorough) vs. full-scope (external + internal + cloud + physical)
- Duration: One week to three months depending on complexity
- Retesting: Budget another 20–40% for retest engagements after remediation
Red Flags in Low-Cost Offers
If a provider quotes a pen test at $1,500 with a one-week turnaround, it's likely automated scanning with a templated report. Real manual testing requires experienced professionals billing at $150–$250+ per hour.
Ask prospective testers: Will you exploit vulnerabilities, or just report them? Do you include post-exploitation assessment? Who writes the report—a junior analyst or the lead tester? These answers reveal whether you're hiring actual pen testers or vulnerability scanners.
Mercoly makes it easier to compare and vet penetration testing providers—you can see credentials, scope offerings, and past client reviews in one place.
Frequently Asked Questions
Q: How often should we do penetration testing? Annual testing is standard for most organizations, though high-risk industries (finance, healthcare) often test twice yearly or after major infrastructure changes.
Q: Can we do penetration testing on production systems? Yes, but it requires careful planning, emergency contacts, and clear windows. Most testers work outside business hours or in staging environments that mirror production.
Q: What's the difference between penetration testing and vulnerability assessment? Vulnerability assessments identify weaknesses; penetration tests exploit them to prove real-world impact. Assessments are scanning-heavy and cheaper ($2,000–$10,000); pen tests are exploitation-focused and more expensive.
Ready to compare penetration testing providers tailored to your needs? Start your search on Mercoly today.