PROFESSIONALLY EVIL EDUCATIONAL RESOURCE
What is a Penetration Test?
Penetration testing – also known as ethical hacking or pentesting – is a proactive cybersecurity practice where security experts conduct simulated, real-world cyberattacks to discover vulnerabilities in computer systems, networks, web applications, and underlying infrastructure. The objective is to identify potential weaknesses, so they can be remediated before external threat actors can exploit them.
The penetration testing process identifies those vulnerabilities, and evaluates an organization’s capacity to detect, respond to, and mitigate cyber threats effectively. By performing a penetration test, organizations can gain an authentic understanding of their cybersecurity posture, which allows them to assess the effectiveness of existing security measures, and implement remediations or patches that may prevent future attacks.
Put simply: When you know what’s a potential risk, you know where to put your energy into prevention.
Penetration testing gives decision makers the knowledge to implement targeted security enhancements and improve their incident response plans. The information gathered from these tests also enables business leaders to make wise investments in cybersecurity.
01 - Definition
What is Penetration Testing?
Penetration testing is a method of assessing existing systems, assets, and networks to identify vulnerabilities and real-world attack vectors, by attempting to trigger those vulnerabilities through controlled, simulated attacks. This helps organizations identify avenues for safeguarding their sensitive data, assets, and reputation.
Security professionals adopt an attacker’s mindset (hence our “Professionally Evil” tagline) while adhering to the highest ethical standards.
With expert guidance from a penetration tester, organizations gain a deeper and grounded perspective on real-world threats and critical risks they may not yet be prepared for, rather than making guesses based on the tools and procedures the organization has in place.
The risk of any vulnerability isn’t limited to what that single vulnerability exposes, it’s also whatever that vulnerability makes possible for an attacker to do next. For example:
- A single exposed protocol could lead to credential capture.
- Captured credentials could then lead to lateral movement.
- Lateral movement could lead to domain admin access.
A network pentest maps that entire attack chain, not just the individual weak points. This lets your team can see exactly what points you can break the chain, rather than chasing findings one at a time.
For organizations under the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), or similar regulatory frameworks, this same testing also satisfies the recurring assessment requirements.
02 — Approaches
Are there Multiple Types of Penetration Testing?
In addition to frequency of testing, there are also different approaches and targets that pentesting engagements can focus on.
Penetration testing can be performed as a standalone engagement, or on a regular, recurring schedule, such as annually or bi-annually. Testing is also a good idea whenever an organization makes a significant change to its environment.
There are different kinds of penetration tests, which mostly vary depending on the people involved in the testing, and the assets being targeted, including:
Network Penetration Testing
Identifies vulnerabilities an attacker could exploit to gain unauthorized access to the network, data, and corporate assets, including firewalls, routers, and switches.
Application Penetration Testing
Focuses on web and desktop applications, looking for ways to tamper with configuration, steal data, or bypass authentication, including third-party integrations.
Mobile Penetration Testing
Covers apps built for the Android and iOS ecosystems specifically.
API Penetration Testing
Examines API endpoints and infrastructure, mapping structures and identifying weaknesses in how the API itself behaves.
Red Team Engagements
Simulates real-world attacks to test an organization’s overall preparedness and response, not just a single system’s defenses.
Purple Team Engagements
Combines red team testers with an organization’s existing security team to collaboratively improve detection and response together.
Physical Penetration Testing
Tests physical controls to identify weaknesses in employee awareness and procedures around unauthorized access to offices and data centers.
IoT & Embedded Device Testing
Requires specialist knowledge covering firmware, network interfaces, access controls, and wireless communication protocols.
03 — Rationale
Why Perform Penetration Tests?
Many businesses conduct penetration tests to meet various security-related goals. The primary goal is identifying any potential underlying security problems in software, network architecture, access controls, or devices before an attacker can exploit them.
Penetration testing can also be used to test an existing team’s response to cyberattack scenarios. As the penetration test team conducts simulated attacks, the organization’s tools and security personnel may identify suspicious traffic or intrusion attempts. This is most common in Red and Purple Team engagements, but can occur in most kinds of penetration testing. Some engagements work from an “assumed breach” posture, operating as though an attacker had already gotten past some defenses. This allows for a deeper test, and these scenarios may use whitelisted IP addresses or other security bypasses agreed upon beforehand.
Penetration tests may be required by law to meet established compliance requirements, such as those laid out by PCI DSS. These compliance requirements benefit an organization by informing their risk management strategy. They also demonstrate a dedication to security to potential clients, increasing customer trust.
04 — Threat Landscape
Cyberattacks and Vulnerability Preparation
Tens of thousands of new vulnerabilities are discovered every year. This means it is effectively impossible for organizations to track every flaw, or even know which ones might present the greatest real risk. Patching takes time, and endless patch loops aren’t the answer. Managing defense requires risk-based assessment and frequent testing.
The threats most likely to harm (according to the Verizon DBIR Report) organizations include network intrusion, zero-day vulnerabilities, and ransomware. Common software weaknesses include Cross-Site Scripting (XSS), improper authentication, access control errors, and security misconfigurations.
As a baseline, MITRE’s CWE Top 25 Most Dangerous Software Weaknesses and the OWASP Top Ten are strong starting points for strengthening a security program.
The specific threats your organization may face will vary, based on your industry, size, security maturity, and other factors. A penetration test can help you determine the best threats to prepare for, and the security gaps or flaws that most need addressing.
Read More
- What Risks Does the Dark Web Pose to Businesses?
- Four Steps to Prepare Your Application for a Denial of Service Attack
- Top Ten AWS Security Configurations: Mitigating Risk in the Cloud
- The Client-Side Security Trap: A Warning For Developers
- What Are SQL Injection Vulnerabilities, and How Do You Prevent Them?
05 — Mechanics
How Do Penetration Tests Work?
You can only protect yourself against the weaknesses you know about. Penetration testing helps you find those weaknesses. It’s a proactive way to confirm an organization is taking the necessary steps to secure systems and data against malicious intrusion, and regularly conducting tests identifies previously undiscovered weaknesses that might otherwise lead to a breach.
The findings of your penetration test are delivered in a detailed report: an executive overview describing the engagement and a plain-language summary of results, followed by a narrative walking through the team’s process, procedures, and discoveries. Each finding is described in specific technical detail and linked to an actionable, practical remediation path.
Read more about the importance of addressing security here.
06 — Decision-Making
Outsourced Penetration Testing vs Hiring In-House?
Some organizations have internal penetration testing teams, while many others contract with external cybersecurity consulting firms, like Secure Ideas. Whether you create an internal “red team” to perform security testing, bring in outside help, or both, depends heavily on your organization’s needs and security goals.
Ultimately, the choice between in-house and outsourced penetration testing depends on your organization’s specific needs, resources, and long-term security strategy. The following factors may determine the most effective approach for your situation:
-
Security ProgramsExisting in-house security specialists have a lot to keep up with. They need tools, training, and time to stay current with security testing processes. Generalists are great, until they aren't. It may be wise to capitalize on the dedicated expertise of independent pentesting firms.
-
Budgetary ConsiderationsSecurity can be expensive, but there are options that fit most budgets. Consider whether your organization has enough ongoing security and technology work to keep an internal specialist busy. If not, an idle pentester may be an expensive proposition.
-
ComplianceRegulatory compliance may be a factor. You may need to hire companies with specific certifications and qualifications, or you may be unable to meet legal demands with your existing in-house teams.
-
Contractual ObligationsContracts that require third-party attestation of your system's security may necessitate the assistance of an outsourced penetration testing service.
-
RolesConducting a penetration test requires specific skills and experience. It can be difficult to hire enough professionals for in-house roles to manage consistent penetration testing, so outsourcing may be more realistic and cost-effective.
You should answer these questions as you decide whether to create your own team or work with outside resources:
-
Expertise & SpecializationTesting requires specific, evolving skills. Can an in-house team maintain that, or would outside specialists serve better?
-
Resource AllocationDo you have enough ongoing work to justify a full-time in-house tester, or does outsourcing offer more flexibility?
-
Compliance RequirementsSome frameworks require specific certifications, such as CREST. Can you confirm that your chosen approach satisfies them?
-
Contractual ObligationsSome client or partner contracts require an independent third-party assessment or a formal letter of attestation. Do you have regulatory or contractual obligations to consider?
-
Objectivity & Fresh PerspectiveExternal testers offer an unbiased view, potentially uncovering blind spots an in-house team might overlook. How can you get a similar perspective from an internal team?
-
Knowledge TransferConsider how testing insights get shared and integrated into your overall security strategy either way. What tools and reports will you need to manage test results?
07 — Investment
How Much Does a Penetration Test Cost?
The cost of an engagement depends on the client’s specific needs. The most significant factors are the scope (number of assets) of the engagement and the effort required, testing a small web application takes meaningfully less time and effort than testing an entire corporate network and its associated assets.
Typical cost range for most engagements, varying based on whether you need a standalone test or continuous testing, whether you purchase credits for on-demand analysis, and whether your project has special reporting requirements. Volume discounts may be available when multiple tests are quoted together.
08 — Ethics
A Note on Ethics
One of the main ethical considerations for a penetration test is permission. Reputable security consulting companies will always perform penetration testing under contract, with explicit Scopes, Rules of Engagement (RoE), or similar boundaries discussed beforehand.
We cannot speak for all penetration testing firms, but Secure Ideas’ penetration testing services prioritize the safety and security of your intellectual property and assets throughout. Our consultants thoroughly examine every in-scope system to identify exploitable flaws and weaknesses while avoiding unnecessary risk to your business operations.
Responsibility is at the core of our services. We handle your assets and information with discretion and ethical care, from the first day of an engagement through the final report.
09 — Methodology
The Process
Every engagement runs through the same six stages, whether it’s a five-day web application test or a multi-week network and physical assessment. The following outlines the steps that Secure Ideas takes when planning and executing a pentest.
STEP 1
Scoping
Once you decide to conduct a penetration test, you need to determine the engagement’s scope.
Map a plan that can help you meet your goals. A single test might be sufficient to meet compliance requirements, such as a checkbox for a contract your organization wants. However, if you aim to improve your organization’s overall security, regular penetration tests can be more effective. Make those needs and goals concise and clear before you engage a third party. This ensures that your chosen partner can meet expectations. During this preliminary process, consider the following questions:
- Timelines: Do you have a timeline that needs to be met? Or is scheduling flexible?
- Scope: Determine which systems, networks, and applications should be tested, noting sensitive assets that might need to be removed from scope or tested with extreme caution so as not to disrupt operations.
- Black, gray, or white box testing: Do you need to provide information and code for target systems?
- Specific requirements: Do you need specific tests or reviews? Is a full penetration test required, or do you need to focus on specific areas?
- Budget: How much have you allocated to cybersecurity initiatives? What budget allocation is suitable, or available, for a penetration test? If the budget doesn’t stretch to cover everything on your requirements list, what changes are you able to make to the budget or the scope?
- Regulations: Is a penetration test necessary to meet compliance requirements with specific regulations? If so, which regulations, and how frequently must testing be conducted?
This information helps define the scope of the pentest. The scope is critical, because it dictates how many assets, testers, resources, and hours the test is expected to take. The more information you can provide up front, the faster and more accurately the assessment team can perform their work. If the scope is larger than expected, some assets may not get tested properly; if smaller than expected, work may complete before the engagement ends.
After providing this information to your consultants or pentest team, expect a formal Statement of Work (SoW) that outlines the description of services, the engagement’s goals, methodologies, in-scope assets, and objectives.
What’s in Scope
Now, when it comes to what’s being tested, penetration testing experts can help you tailor elements that match your organization’s unique requirements. Those are based on risk assessments and regulatory or compliance requirements.
For instance, you might have attention on specific areas of the corporate environment, such as a network, data center, or legacy computing assets. A recent security incident would make you sensitive to additional vulnerabilities to explore.
Pay attention to compliance requirements. If your organization handles sensitive information, it may need to meet specific standards such as PCI DSS, which would require the Cardholder Data Environment (CDE) to be included in the project scope.
Don’t try to get too granular. When in-scope tests are too narrow, vulnerabilities and security flaws can be overlooked, which may impact the overall quality of a penetration test and the usefulness of its recommendations. The penetration testing experts will let you know if your scope is too large for the test you are trying to plan.
As far as setting priorities, protecting any non-public, sensitive datasets should be at the top. This includes confidential and proprietary information that belongs to an organization or its customers, such as Protected Health Information (PHI), financial and banking information, and potentially non-public Personally Identifiable Information (PII), depending on the context and content of the records. That includes proprietary data, including intellectual property, employee records, contracts, and legal documents.
STEP 2
Contract
With scope defined, the engagement becomes formalized. This is where the Statement of Work from scoping becomes a signed agreement, along with a Master Service Agreement if one isn’t already in place, covering the legal and business terms that govern the relationship: deliverables, timeline commitments, payment terms, confidentiality and data handling, liability, and how either side can escalate or exit if something goes wrong.
This step also locks in the Rules of Engagement (RoE), the specific boundaries testers will operate within, so there’s no ambiguity later about what’s permitted once testing begins. A signed contract protects both sides: it gives your organization a clear, enforceable commitment on what you’re getting, and it gives the testing team explicit authorization to do the work without legal exposure.
Nothing in the following steps should start before this is finalized.
STEP 3
Scheduling
With the paperwork in place, the consulting firm typically begins assigning resources to the test. Lead times for engagements will vary depending on the time of year, consultant availability, and other factors.
If you have relevant staff who may be out during the test, or other potential obstacles to availability, let the consultants know as early as possible. This may not impact testing, but early and frequent communication can ensure that everything runs smoothly.
Recurring Testing
The frequency of penetration tests is determined by a client’s unique needs and security challenges. Many of today’s security standards, including NIST 800-53 and ISO/IEC 27001, recommend penetration testing but do not specify exact timelines. Data protection laws, such as PCI DSS and HIPAA, also promote regular security evaluations.
PCI DSS, for example, requires at least an annual penetration test or one after any significant environmental changes. Additionally, frequent segmentation validation of the Cardholder Data Environment (CDE) against non-CDE environments may be necessary. The maturity of your existing security program, specific regulatory and compliance demands, and customer and service level agreements determine the best schedule for you.
STEP 4
Kick-off
A Kick-off call typically occurs around 2 weeks before the start of the engagement, and it allows the testing team and your team to meet each other, talk through the initial details, and prepare any final details. Together, you’ll set expectations: review the scope, contact information, schedule, rules of engagement, and any action on indications of compromise (IoC). In addition, the team should discuss whether any sensitive systems are in scope.
To prepare for you pentest, you must assemble the relevant and requested information before a pentest engagement begins. That may include technical information and asset lists depending on the project scope. Provision any accounts or resources that the consultants may need for testing at this time. If testers need those accounts, and do not have access on the start date, testing cannot begin.
STEP 5
Test Execution
Trustworthy penetration test providers follow a methodology, such as the Penetration Test Execution Standard (PTES). During the execution phase, the teams perform activities that may include threat modeling, reconnaissance, vulnerability discovery, exploitation, and potentially post-exploitation.
- Threat Modeling: A threat model is an approach to understanding the possible risks and attackers relevant to an organization and a scope. To create a model of the relevant threats, the penetration tester must first gather relevant documentation, identify and categorize the target assets, then identify and categorize threats or threat communities.
- Reconnaissance: During this early phase of testing, a penetration tester gathers information about the organization by enumerating accessible assets, fingerprinting Internet-facing applications and devices, and checking public records or social media about the organization. This allows the tester to identify potential attack vectors to use at later stages of the assessment.
- Vulnerability Discovery: The tester begins testing each of the attack vectors identified during reconnaissance, or during scoping conversation, and attempts to locate vulnerabilities that could lead to deeper access. Relevant vulnerabilities are documented for the report.
- Exploitation: Testers attempt to exploit the identified vulnerabilities through controlled attacks based on real-world techniques. Any access gained is documented for the report. Communication and further exploitation attempts may occur depending on the RoE for this engagement.
- Post-exploitation: After gaining access during exploitation, the penetration tester attempts to deepen that access, exfiltrate data, modify settings, or perform other post-exploitation activities to demonstrate the risk of an attacker reaching the same point. The types of activities depend on the vulnerability and the established RoE.
This provides a general description of the PTES methodology and its phases. The actual phases and testing during your assessment may vary depending on the type of penetration test you are performing, the methodology used, and the Scope and RoE for that assessment.
Testing Timeframes
Under ordinary circumstances, the active testing window for most penetration tests varies from three to ten days, depending on the test scope.
The total time of an engagement depends on various factors, including pre-engagement activities and reporting, typically ranges from two to four weeks; the practical test and report often takes an additional one to two weeks. However, the timeline for a penetration test depends on scope, budgetary considerations, requests for specialized requests or deliverables, and time frame constraints.
STEP 6
Reports & Deliverables
We provide a detailed report for both technical and non-technical audiences, combined with practical, realistic, and actionable remediation guidance.
We design and refine our deliverables to make a clear, transparent, and concise case for the necessary changes. We also ensure that both technical and executive personnel can process and understand our findings in a digestible, clear manner.
We aim to help teams prioritize the areas of greatest concern and risk while assisting key stakeholders in making informed, rapid decisions that benefit their business. Our intent is that these reports help organizations get better support from upper management to strengthen their security. Secure Ideas, as a trusted third-party and subject matter expert, can provide recommendations to key stakeholders that might not get the recognition deserved when previously raised by the organization’s personnel.
Review Process
The time required to issue reports and deliverables depends on the scope of your penetration test and the testing window available. For instance, a limited, short pentest with a five-day testing window takes less time to analyze and compile a report than does an extensive, full network and physical asset penetration test.
When possible, we issue a draft report while finalizing the main report. Typically, clients are given five business days to review and respond once a report is issued. For example, clients may wish to update or request changes to the final report, such as changing risk indicators based on business processes or after the provision of further information.
Engagement Debriefs
Once a report is accepted and finalized, Secure Ideas may conduct formal presentations and executive-level overviews or discuss the report’s findings in depth with technical staff. The issuance of a report and suggestions for remediation doesn’t necessarily mean the end of the journey. Penetration testers may provide further consultancy and advisory services, offering additional strategic guidance on tackling emergent security issues.
The time required for remediation and resolving any concerns raised by a penetration test is determined on a case-by-case basis. It may depend on an organization’s security program maturity level, resources, and the number and nature of issues needing to be resolved.
At Secure Ideas, we typically request that any retesting is scheduled and completed within 90 days of a final draft report being delivered, but this time frame can be flexible depending on the client’s needs.
STEP 7
Finalization & Next Steps
Traditional, standalone penetration tests are not always compatible with the agile nature of today’s software development lifecycle (SDLC) and DevOps workflows.
Instead, we recommend a series of steps to embed security testing within the SDLC processes. While we go into detail in a blog post on the subject, the problem should be tackled in three steps:
- Training: Security training should benefit development teams, not disrupt their projects or overwhelm them. You can opt for internally or externally maintained training, or both, to keep training digestible and suitable for compliance purposes.
- Advisory: Create an advisory program built on the foundation of effective training. Advisors should have development experience to understand goals, procedures, and concerns.
- Assistance: Your training program must include assistance, such as live guidance, testing platforms, and frequent reviews.
Letter of Attestation
Many engagements close with an attestation letter, an independent third-party statement confirming that an organization has adequate protection in line with industry standards. These letters add a layer of outside credibility that’s often required by auditors, partners, or contracts, and Secure Ideas provides them as part of the standard engagement process.
10 — Questions
Frequently Asked Questions
What is a Penetration Test and why is it important?
A penetration test simulates attacks on your systems to identify vulnerabilities and potential entry points before malicious actors can exploit them. Unlike an external threat actor, a penetration tester is performing tests with your explicit permission, and reporting all findings directly to your security team to fix.
Penetration testing helps organizations proactively reduce risk, comply with regulatory requirements, such as the Payment Card Industry Data Security Standard (PCI DSS), the US Health Insurance Portability and Accountability Act (HIPAA), the US Gramm-Leach-Bliley Act (GLBA), or the EU’s Digital Operational Resilience Act (DORA), assess security control effectiveness, and protect critical assets like customer data and intellectual property. Effective testing requires comprehensive coverage, experienced professionals, and risk-focused analysis rather than automated scanning alone.
Why do I need a penetration test?
You cannot fix what you cannot see. During testing, vulnerabilities can be systematically identified and documented. This allows you to implement remediations that can strengthen your overall defenses, help prevent breaches, and ease the path to compliance with today’s data protection laws.
A penetration test shows that an organization is proactively securing digital assets and data against malicious intrusion. Some regulatory compliance frameworks also require organizations to have penetration testing performed.
What's the difference between penetration testing and vulnerability scanning?
Penetration testing actively simulates attacks to exploit vulnerabilities and assess real security posture, with a person mimicking attacker behavior. A penetration tester performs specific tests against the assets and devices they identify in your network, and attempt to bypass security controls using real-world attack techniques.
By comparison, vulnerability scanning is a passive activity Vulnerability scans are automated tools that compare your systems against databases of documented or known issues. Scanning should happen regularly as a baseline, but it lacks the context a real assessment needs on its own.
How long does it take to do a penetration test?
This depends on the scope of a given engagement. Active testing typically runs three to ten days depending on scope. The full engagement, including pre-engagement work and reporting, usually spans two to four weeks.
How often does my organization need a penetration test?
In most cases, annually, or whenever a significant change occurs to a system or application. Specific requirements vary by regulation, internal policy, and the scope of a given engagement.
What is the Penetration Testing process?
The penetration testing process includes three phases:
- Before testing, we conduct scoping calls to define objectives and develop a customized Statement of Work (SoW).
- During testing, we follow relevant testing methodologies specific to your test type, maintain regular communication, and provide 24/7 availability for concerns. At this point, the team follows an existing penetration testing methodology, such as Penetration Test Execution Standard (PTES), which includes the following stages:
- Threat Modeling: Testers create a model that covers your assets and potential threats.
- Reconnaissance: Testers review your reachable assets and public data.
- Vulnerability Discovery: Testers attempt to identify vulnerabilities on the identified assets.
- Exploitation: Testers attempt to exploit the identified vulnerabilities.
- Post-exploitation: Testers attempt to expand their access from previous exploitation.
- After testing, we deliver a draft report for review, schedule an optional debrief call, and finalize findings with actionable recommendations.
How do I prepare for a Penetration Test?
There are key steps your team can take to ensure you are properly prepared, which ensures that testing starts on schedule and maximizes value. These requirements should be completed before the start of testing, and include:
Provisioning multiple user accounts for different roles
Ensuring code stability (it should pass QA first)
Whitelisting tester IPs in perimeter controls when appropriate
Providing necessary testing assets like application binaries or API documentation
Plan for administrative tasks like VPN access and change windows at least a week in advance. Clear communication through a kickoff call helps identify potential delays before they impact testing quality or timeline.
How much does a Penetration Test Cost?
Most penetration tests range from $10,000 to $45,000, depending on scope (type, breadth, and depth of testing) and the vendor’s hourly rate ($200-$500/hr). A single web application typically costs less than comprehensive internal and external network testing. Factors like compliance requirements, after-hours testing, and retesting affect pricing. Control costs by clearly defining scope, providing detailed information upfront, and bundling multiple tests.
What are the ethical and legal considerations for Penetration Testing?
Penetration testing requires explicit authorization, clear documentation of scope, and strict confidentiality protocols. Testers must be transparent about their methods and ensure testing doesn’t harm systems or stakeholders. Organizations must comply with regulations like the US Computer Fraud and Abuse Act (CFAA), US Electronic Communications Privacy Act (ECPA), and EU General Data Protection Regulation (GDPR), maintain detailed testing records, and work with qualified professionals to mitigate liability. Proper planning ensures testing is both effective and responsible.
What are the risks of a Penetration Test?
Penetration testing carries inherent risks including potential system outages, inadvertent exposure of sensitive data, masking of real attacks, and temporary productivity loss. The biggest risk factors stem from inexperienced testers or unexpected system behaviors. Choosing an experienced, reputable testing partner with clear communication protocols and rules of engagement significantly minimizes these risks while maximizing the value of your security assessment.
What's the difference between API and Web Application Pentests?
A web application penetration test examines the application as users interact with it, including browser-based vulnerabilities and the API calls the application makes. An API penetration test focuses on the backend logic, authorization, and authentication mechanisms of the API itself. Since web applications often use only a small portion of an API’s total functionality, testing just the web app can leave significant API vulnerabilities unexamined. Organizations relying on internal or third-party APIs need testing that covers both layers.
Read More About The Difference Between Web App and API Pentests Here ›
How is my data protected during and after Penetration Testing?
Reputable penetration testing firms protect your data through three core principles:
Discretion in what data is accessed and how
Secure transmission and storage using encrypted channels and AES-256 encryption at rest
Strict retention policies that destroy test artifacts shortly after report finalization.
Testers exercise judgment to minimize unnecessary data collection, using screenshots and redaction when possible. All data handling follows responsible security practices, with customizable retention periods available to meet your operational or regulatory requirements.
Can we see a sample report from a Penetration Test?
Absolutely. Any reputable penetration testing company should provide sample reports upon request. Reports are your primary deliverable and should include an executive summary, testing narrative, detailed findings with risk ratings, replication steps for verification, and actionable remediation recommendations. Not all reports are created equal, so reviewing samples helps ensure the format and content meet your needs. Most companies will accommodate reasonable modifications to reporting formats.
What is Professionally Evil Testing as a Service (PETaaS®)?
PETaaS® is on-demand pentesting services, which provides you with continuous access to our penetration testing expertise rather than a one-time assessment. This approach offers on-demand or scheduled testing, which integrates with your software development lifecycle, and delivers regular vulnerability analysis with ongoing support. While it may initially appear more expensive than traditional testing, PETaaS® is significantly more cost-effective than hiring full-time security staff and provides proactive, real-time vulnerability identification.
Note: The industry lacks a standard definition for penetration testing as a service, so verify that your provider’s approach aligns with your expectations.