A penetration test is an authorised, controlled attack on your systems by security professionals. The goal is to find weaknesses before criminals do, then fix them. Here is what that involves and when you need one.
Types of penetration tests
- Web application testing: websites, portals and APIs, checked against risks such as the OWASP Top 10.
- Mobile app testing: iOS and Android apps and the APIs behind them.
- External network testing: everything your company exposes to the internet.
- Internal network testing: what an attacker could do once inside your office network.
- Cloud configuration review: AWS, Azure and Microsoft 365 settings.
- Social engineering: phishing simulations that test people, not just technology.
How a test works
- Scoping: agree what is tested, when and how, in writing.
- Reconnaissance: testers map the target the way an attacker would.
- Testing: automated scanning plus manual techniques to find and safely confirm vulnerabilities.
- Reporting: findings ranked by risk, with evidence and clear fix steps.
- Retest: confirm that fixes work.
When you need a penetration test
- Before launching a new website, app or portal.
- After major changes to systems or infrastructure.
- At least yearly if you handle personal, health or payment data.
- When clients or partners require it in security questionnaires.
What drives the cost
Scope is the main factor: the number of applications, user roles, APIs, IP addresses and the depth of testing required.
Our cybersecurity team, including certified ethical hackers, runs penetration tests and helps fix what they find.
Frequently asked questions
Is penetration testing the same as a vulnerability scan?
No. A scan is automated and finds known issues. A penetration test adds human expertise to confirm, chain and prioritise real risks.
Will testing break my website?
Professional testers agree rules of engagement to avoid disruption and can test staging environments.
How long does a test take?
Small web applications may take a few days of testing; larger scopes take longer, plus time for reporting.