Penetration Testing

What is a Pentest? Complete Guide to Pentesting in 2026

  • Written by John Price
  • Reviewed by Kevin Schewe and Ratan Gupta
  • 26 min read
A pentest, short for penetration test, is an authorized, simulated cyberattack performed by security professionals to identify and exploit vulnerabilities in systems, networks, and applications before malicious actors can. With 60% of organizations experiencing security breaches due to unpatched vulnerabilities and misconfigurations, pentesting has become essential for validating security controls and preventing costly data breaches. This comprehensive guide covers everything you need to know about pentests, from fundamental concepts to selecting the right pentesting services for your organization.

Table of Contents

What is a Pentest?

A pentest (penetration test) is a controlled, authorized security assessment where skilled professionals simulate real-world cyberattacks to identify exploitable vulnerabilities in an organization's security posture. Unlike passive security assessments, pentesters actively attempt to breach defenses, gain unauthorized access, escalate privileges, and access sensitive data, exactly as malicious hackers would, but with permission and professional ethics.

The fundamental goal of pentesting is to answer critical security questions:

  • "Can an attacker gain unauthorized access to our systems?"
  • "If breached, what damage could they cause?"
  • "How effective are our security controls against real attacks?"
  • "What is our actual security risk, not just theoretical?"

Pentest vs. Ethical Hacking

The terms "pentest" and "ethical hacking" are often used interchangeably, but have subtle differences:

Pentesting: Structured, time-bound assessment with defined scope, rules of engagement, and formal reporting. Focuses on identifying vulnerabilities that could impact business.

Ethical Hacking: Broader term encompassing all authorized hacking activities. May be less formal, more exploratory, and include security research beyond traditional pentest boundaries.

In practice, most organizations use "pentest" when referring to formal security assessments.

What Pentesters Look For

Professional pentesters systematically search for security weaknesses across multiple categories:

  • Network Vulnerabilities: Weak firewall rules, exposed services, protocol weaknesses
  • Application Flaws: SQL injection, XSS, authentication bypasses, business logic errors
  • Configuration Issues: Default credentials, unnecessary services, weak encryption
  • Access Control Weaknesses: Privilege escalation opportunities, broken authorization
  • Human Vulnerabilities: Social engineering susceptibility, security awareness gaps
  • Physical Security Gaps: Tailgating opportunities, unsecured facilities
  • Architectural Flaws: Network segmentation issues, insecure designs
The Pentest Philosophy: Pentesters operate with an adversarial mindset, thinking like attackers to discover unconventional attack paths that automated tools miss. This creative, exploratory approach uncovers complex vulnerability chains that might seem insignificant individually but enable devastating attacks when combined.

Why Pentesting Matters for Your Security

Pentesting provides critical security benefits that justify the investment:

1. Validates Real-World Security Effectiveness

Organizations invest heavily in firewalls, antivirus, intrusion detection, and other security technologies. But do these controls actually work against skilled attackers? Pentesting answers this question definitively.

According to research by the Ponemon Institute:

  • 45% of organizations discover their security controls don't work as expected during pentests
  • 38% find critical vulnerabilities in systems they believed were secure
  • Organizations that pentest regularly experience 51% lower breach costs

2. Discovers Vulnerabilities Before Attackers Do

The average cost of a data breach in 2023 was $4.45 million. Finding and fixing vulnerabilities through pentesting (typical cost: $15,000-$40,000) represents less than 1% of potential breach costs.

Cost Comparison:

  • Annual pentest investment: $15,000-$40,000
  • Average data breach cost: $4.45 million
  • ROI: Preventing one breach justifies 100+ years of pentesting

3. Meets Compliance and Regulatory Requirements

Many frameworks explicitly require pentesting:

  • PCI DSS Requirement 11.3: Conduct external and internal penetration testing at least annually
  • HIPAA: Requires regular technical and non-technical security evaluations
  • SOC 2: Pentests provide evidence of effective security controls
  • GDPR: Demonstrates appropriate technical security measures
  • ISO 27001: Recommends regular technical vulnerability testing

4. Provides Security Assurance to Stakeholders

Pentest results provide credible evidence of security to:

  • Customers: Demonstrating data protection commitment
  • Partners: Meeting vendor security requirements
  • Investors: Showing security due diligence
  • Board/Executives: Quantifying security posture
  • Auditors: Validating security control effectiveness
  • Insurers: Supporting cyber insurance applications

5. Identifies Critical Risk Priorities

Pentests provide data-driven insights for security investment:

  • Which vulnerabilities pose the greatest risk?
  • Where should security budget be allocated?
  • What security controls need improvement?
  • Are recent security investments effective?

6. Tests Incident Response Capabilities

Pentests validate whether security teams can detect and respond to attacks:

  • Do monitoring systems generate appropriate alerts?
  • Can SOC analysts detect intrusion attempts?
  • Are incident response procedures effective?
  • How quickly can teams contain breaches?
Reality Check: In 2022, a major healthcare provider discovered during a pentest that attackers could access 2.3 million patient records through a vulnerable web portal. The organization believed their security was strong, multiple security tools, compliance audits passing, no previous incidents. The $28,000 pentest prevented an estimated $115+ million breach. This illustrates why real-world testing is essential regardless of other security measures.

Professional Pentesting Services

subrosa's certified pentesters provide comprehensive security assessments tailored to your organization's risk profile, technology stack, and compliance requirements.

Schedule Your Pentest

Types of Pentests Explained

Different pentest types target specific aspects of security infrastructure:

1. Network Pentesting

Network pentests assess security of network infrastructure including routers, switches, firewalls, and network segmentation.

External Network Pentesting

Perspective: Simulates attacks from the internet against public-facing systems.

Common Focus Areas:

  • Perimeter firewall effectiveness
  • Exposed services and ports
  • VPN security and remote access
  • Web server configurations
  • Email server security
  • DNS security and zone transfers

Typical Cost: $5,000-$20,000

Duration: 3-7 days

Internal Network Pentesting

Perspective: Simulates insider threats or attackers who've gained initial access.

Common Focus Areas:

  • Lateral movement capabilities
  • Privilege escalation opportunities
  • Network segmentation effectiveness
  • Internal system vulnerabilities
  • Active Directory security
  • Sensitive data access controls

Typical Cost: $10,000-$30,000

Duration: 5-10 days

2. Web Application Pentesting

Web app pentests focus on security vulnerabilities in web-based applications and APIs.

Testing Coverage:

  • OWASP Top 10: SQL injection, XSS, broken authentication, security misconfigurations
  • Business Logic: Workflow bypasses, authorization flaws
  • Session Management: Token security, session hijacking
  • API Security: REST/GraphQL endpoint vulnerabilities
  • File Upload: Malicious file upload and execution
  • Authentication: Login bypass, credential brute forcing

Typical Cost: $8,000-$30,000

Duration: 5-14 days

3. Mobile Application Pentesting

Mobile pentests assess iOS and Android application security.

Testing Areas:

  • Insecure data storage on devices
  • Weak cryptography implementations
  • Insecure communication and API calls
  • Authentication and authorization flaws
  • Code tampering and reverse engineering
  • Platform-specific vulnerabilities

Typical Cost: $12,000-$35,000

Duration: 7-14 days

4. Wireless Pentesting

Wireless pentests evaluate WiFi, Bluetooth, and other wireless protocol security.

Testing Focus:

  • WPA/WPA2/WPA3 security assessment
  • Rogue access point detection
  • Wireless encryption strength
  • Guest network isolation
  • Bluetooth device security
  • Evil twin and deauthentication attacks

Typical Cost: $5,000-$15,000

Duration: 3-5 days

5. Social Engineering Pentesting

Social engineering tests assess human vulnerabilities through phishing, pretexting, and manipulation.

Testing Techniques:

  • Phishing Campaigns: Email-based credential theft attempts
  • Vishing: Voice phishing over phone
  • Smishing: SMS-based phishing
  • Physical Social Engineering: Impersonation and tailgating
  • USB Drops: Infected USB devices left in public areas
  • Pretexting: Fabricated scenarios to extract information

Typical Cost: $8,000-$25,000

Duration: 2-4 weeks

6. Physical Pentesting

Physical pentests evaluate facility security and physical access controls.

Testing Activities:

  • Badge access system bypasses
  • Lock picking and physical barrier testing
  • Tailgating and piggybacking
  • Security guard effectiveness assessment
  • CCTV blind spot identification
  • Sensitive document and media handling

Typical Cost: $10,000-$30,000

Duration: 3-7 days

7. Cloud Pentesting

Cloud pentests assess security of cloud infrastructure and configurations.

Testing Focus:

  • Cloud storage permissions (S3 buckets, Blob storage)
  • IAM misconfigurations and overprivileged roles
  • Serverless function security
  • Container and Kubernetes security
  • Cloud API security
  • Multi-tenant isolation

Typical Cost: $15,000-$45,000

Duration: 7-14 days

Pentest Type Primary Target Duration Cost Range
External Network Perimeter defenses 3-7 days $5K-$20K
Internal Network Internal infrastructure 5-10 days $10K-$30K
Web Application Web apps and APIs 5-14 days $8K-$30K
Mobile Application iOS/Android apps 7-14 days $12K-$35K
Wireless WiFi/Bluetooth 3-5 days $5K-$15K
Social Engineering Human vulnerabilities 2-4 weeks $8K-$25K
Physical Facility security 3-7 days $10K-$30K
Cloud Cloud infrastructure 7-14 days $15K-$45K

Pentest Methodology and Phases

Professional pentests follow structured methodologies ensuring comprehensive, consistent assessments:

Phase 1: Pre-Engagement

Establishing scope, objectives, and rules of engagement before testing begins.

Key Activities:

  • Scope Definition: Which systems, networks, or applications will be tested?
  • Testing Approach: Black box, white box, or grey box?
  • Rules of Engagement: What's allowed and prohibited?
  • Timeline: When will testing occur?
  • Legal Authorization: Written permission from system owners
  • Communication Plan: Points of contact and escalation procedures
  • Success Criteria: What constitutes successful pentest?

Documents Produced:

  • Statement of Work (SOW) or contract
  • Rules of Engagement document
  • Scope definition and asset list
  • Authorization letters
  • Non-disclosure agreements (NDAs)

Phase 2: Reconnaissance

Information gathering about the target environment.

Passive Reconnaissance:

  • WHOIS lookups and DNS enumeration
  • Search engine reconnaissance (Google dorking)
  • Social media intelligence gathering
  • Public document analysis
  • Job posting technology stack identification
  • Data breach repository searches

Active Reconnaissance:

  • Port scanning and service detection
  • Operating system fingerprinting
  • Web application enumeration
  • Email address harvesting
  • Subdomain discovery
  • Network mapping

Phase 3: Vulnerability Analysis

Identifying potential security weaknesses through automated and manual techniques.

Assessment Methods:

  • Automated Scanning: Nessus, OpenVAS, Burp Suite
  • Manual Testing: Expert analysis and validation
  • Configuration Review: Identifying misconfigurations
  • Version Analysis: Outdated software identification
  • Authentication Testing: Weak credential discovery

Phase 4: Exploitation

Attempting to compromise systems by exploiting identified vulnerabilities.

Exploitation Activities:

  • Launching exploits against vulnerable systems
  • Bypassing authentication mechanisms
  • SQL injection and web exploitation
  • Password cracking and brute forcing
  • Privilege escalation attempts
  • Demonstrating vulnerability impact

Exploitation Considerations:

  • Risk of system crashes or disruption
  • Production vs. test environment differences
  • Business impact windows (avoid critical times)
  • Data integrity preservation
  • Immediate escalation for critical findings

Phase 5: Post-Exploitation

Assessing the extent of access and potential damage after successful compromise.

Post-Exploitation Goals:

  • Privilege escalation to administrative levels
  • Lateral movement to other systems
  • Data access and exfiltration demonstration
  • Persistence mechanism establishment
  • Pivoting to additional networks
  • Mapping attack impact and business consequences

Phase 6: Reporting and Remediation Guidance

Documenting findings and providing actionable recommendations.

Report Components:

  • Executive Summary: High-level overview for business stakeholders
  • Technical Findings: Detailed vulnerability descriptions
  • Risk Ratings: CVSS scores and business impact
  • Proof of Concept: Exploitation evidence
  • Remediation Steps: Specific fix guidance
  • Strategic Recommendations: Long-term security improvements

Phase 7: Remediation and Re-testing

After organization addresses findings, re-testing validates fixes.

Re-testing Scope:

  • Verify critical and high-severity vulnerabilities are fixed
  • Confirm fixes don't introduce new vulnerabilities
  • Test that security controls work as intended
  • Update report with remediation status
Phase Key Activities Duration
Pre-Engagement Scope, authorization, planning 1-2 weeks
Reconnaissance Information gathering 1-3 days
Vulnerability Analysis Weakness identification 2-5 days
Exploitation Active compromise attempts 3-7 days
Post-Exploitation Impact assessment 1-3 days
Reporting Documentation and presentation 3-7 days

Black Box, White Box, and Grey Box Pentesting

Pentests can be conducted with varying levels of knowledge about the target:

Black Box Pentesting

Knowledge Level: Zero initial knowledge, pentesters start with only the organization name or target IP addresses.

Simulation: External attacker with no insider information

Approach:

  • Extensive reconnaissance phase
  • No credentials or system documentation provided
  • Discover everything through investigation
  • Tests external defenses most realistically

Advantages:

  • Most realistic external attack simulation
  • Tests security from adversarial perspective
  • Reveals what attackers can discover
  • Validates perimeter security effectiveness

Disadvantages:

  • Time-consuming reconnaissance
  • More expensive due to extended timeline
  • May miss internal vulnerabilities
  • Limited coverage given time constraints

Best For: Organizations wanting to understand external threat exposure and validate internet-facing security

White Box Pentesting

Knowledge Level: Complete knowledge, pentesters receive full documentation, credentials, source code, and architectural details.

Simulation: Insider threat or comprehensive security audit

Approach:

  • Minimal reconnaissance needed
  • Full system access and documentation
  • Comprehensive coverage of all systems
  • Focus on deep vulnerability discovery

Advantages:

  • Maximum vulnerability coverage
  • Most efficient use of testing time
  • Identifies complex logical flaws
  • Better value for testing investment
  • Comprehensive security assessment

Disadvantages:

  • Doesn't simulate realistic external attacks
  • May identify unreachable vulnerabilities
  • Requires client preparation time

Best For: Organizations seeking maximum vulnerability discovery, compliance requirements, or comprehensive security audits

Grey Box Pentesting

Knowledge Level: Partial knowledge, typically user-level credentials or limited system documentation.

Simulation: Compromised user account or partial insider access

Approach:

  • Some reconnaissance, some provided information
  • User-level access credentials
  • Limited documentation
  • Balances realism and efficiency

Advantages:

  • Balances realism with coverage
  • Simulates common attack scenarios
  • More thorough than black box
  • Faster than pure black box
  • Evaluates insider threat risks

Disadvantages:

  • May not fully represent external or internal perspectives
  • Knowledge level must be carefully defined

Best For: Organizations wanting realistic assessments with reasonable time and budget, or those concerned about insider threats

Aspect Black Box Grey Box White Box
Information Provided None Limited Complete
Credentials None User-level Full access
Attacker Simulation External hacker Compromised user Insider/auditor
Time Required Longest Moderate Shortest
Cost Highest Moderate Lowest
Coverage Depth External focus Balanced Comprehensive
Realism High for external Moderate Low for external

Pentest Costs and Pricing Models

Understanding pentest pricing helps organizations budget appropriately and evaluate proposals:

Pricing Models

1. Fixed-Price Pentests

Most common for clearly defined scopes:

  • Predictable costs for budgeting
  • Defined deliverables and timeline
  • Scope changes may incur additional fees
  • Typical range: $5,000-$150,000+

2. Time and Materials

Billing based on actual hours worked:

  • Hourly rates: $150-$400+ per hour
  • Flexible for undefined or exploratory scopes
  • Less predictable total costs
  • Good for evolving requirements

3. Retainer-Based Pentesting

Ongoing pentesting relationships:

  • Monthly or annual retainer fees
  • Multiple testing cycles throughout year
  • Often includes remediation re-testing
  • Provides consistent security validation

Cost Factors

1. Scope and Complexity

  • Number of systems, applications, or IP addresses
  • Technology stack complexity
  • Custom applications vs. commercial software
  • Network size and complexity
  • Cloud environments and multi-cloud

2. Testing Duration

  • Small pentests: 40-80 hours ($6K-$15K)
  • Medium pentests: 80-160 hours ($15K-$40K)
  • Large pentests: 160-320+ hours ($40K-$100K+)

3. Testing Approach

  • Black box (highest cost due to time)
  • Grey box (moderate cost)
  • White box (potentially lower cost due to efficiency)

4. Tester Expertise

  • Junior pentesters: $100-$150/hour
  • Mid-level pentesters: $150-$250/hour
  • Senior pentesters: $250-$400+/hour
  • Specialized expertise (IoT, ICS, mobile): Premium rates

5. Urgency and Timing

  • Standard timeline: Base pricing
  • Expedited/rush pentests: 25-50% premium
  • After-hours testing: 10-25% premium

Typical Pentest Costs by Organization Size

Organization Size Annual Pentest Budget Typical Scope
Small (< 100 employees) $10K-$25K External network + 1-2 web apps
Medium (100-1K employees) $25K-$75K External/internal network + multiple apps
Large (1K-10K employees) $75K-$250K Comprehensive multi-type testing
Enterprise (10K+ employees) $250K-$1M+ Continuous testing programs

Additional Costs to Consider

  • Re-testing: $2,000-$10,000 to validate remediation
  • Remediation Support: $150-$300/hour for guidance
  • Travel Expenses: For physical or on-site pentests
  • Emergency Pentests: 25-50% premium for urgent assessments
  • Compliance-Focused Reports: Additional documentation may cost extra

Maximizing Pentest ROI

  • Clear Scope Definition: Well-defined scopes prevent wasted effort
  • Preparation: Have systems, credentials, and documentation ready
  • White Box When Appropriate: Maximize coverage efficiency
  • Schedule Strategically: Avoid rushed or incomplete assessments
  • Act on Findings: Remediate identified vulnerabilities promptly
  • Learn and Improve: Use findings to strengthen security program

Transparent Pentest Pricing

subrosa provides clear, competitive pentesting quotes with no hidden fees. Get customized pricing based on your specific scope and requirements.

Request Your Pentest Quote

Choosing the Right Pentesting Provider

Selecting qualified pentesters is critical for obtaining valuable security insights:

Essential Qualifications

1. Certifications

Verify pentesters hold relevant certifications:

  • OSCP: Offensive Security Certified Professional (gold standard)
  • CEH: Certified Ethical Hacker
  • GPEN: GIAC Penetration Tester
  • GWAPT: GIAC Web Application Penetration Tester
  • CREST: Council of Registered Ethical Security Testers certifications
  • PNPT: Practical Network Penetration Tester

Warning Signs: Be cautious of providers whose testers lack industry-recognized certifications or claim certifications without verification.

2. Experience and Expertise

  • Years of pentesting experience (5+ years for senior testers)
  • Industry-specific knowledge (finance, healthcare, etc.)
  • Technology stack familiarity
  • Verifiable track record and references
  • Case studies demonstrating expertise

3. Methodology and Standards

  • Follows recognized frameworks (PTES, OWASP, NIST SP 800-115)
  • Documented testing procedures
  • Quality assurance processes
  • Consistent risk rating methodologies

4. Insurance and Legal Protections

  • Professional liability insurance ($1M+ coverage)
  • Cyber liability insurance
  • Clear contracts and legal agreements
  • Non-disclosure agreements
  • Liability limitations clearly defined

Evaluating Pentest Proposals

What to Look For:

  • Detailed Scope: Clear definition of what will be tested
  • Methodology: Explanation of testing approach
  • Deliverables: Specific reports and presentations included
  • Timeline: Realistic testing schedule
  • Team Qualifications: Information about actual testers
  • Pricing Breakdown: Transparent cost structure
  • References: Client testimonials and case studies

Red Flags to Avoid

  • Unrealistically low pricing (quality pentesters cost appropriately)
  • Overly aggressive sales tactics
  • Lack of formal methodology
  • Unwillingness to provide references or certifications
  • No professional liability insurance
  • Vague or poorly defined scope
  • Claims of "100% security" or guarantees
  • Offshore-only teams for highly sensitive environments

Questions to Ask Potential Providers

  1. What certifications do your pentesters hold? Can I verify them?
  2. How many years of experience do your actual testers have?
  3. Can you provide references from similar organizations?
  4. What methodology do you follow?
  5. Can I see a sample report?
  6. How do you handle critical findings during testing?
  7. What's your approach to minimizing business disruption?
  8. Do you offer remediation re-testing?
  9. What insurance coverage do you maintain?
  10. How do you ensure data confidentiality?
  11. What happens if testing causes system issues?
  12. Will I meet the actual testers before engagement?

Most Common Pentest Findings

Pentests consistently uncover certain vulnerability categories:

1. Authentication and Access Control Issues (Found in 65%+ of Pentests)

Common Vulnerabilities:

  • Weak password policies allowing simple passwords
  • Default credentials on systems and applications
  • Broken authentication mechanisms
  • Insufficient account lockout policies
  • Missing multi-factor authentication
  • Privilege escalation opportunities
  • Inadequate authorization checks

Example Exploitation: Pentester discovers default admin credentials on network equipment, gains administrative access, captures network traffic, extracts additional credentials, and moves laterally throughout network.

2. Unpatched Systems and Software (Found in 55%+ of Pentests)

Common Issues:

  • Operating systems missing critical security patches
  • Outdated third-party applications
  • End-of-life systems without support
  • Known CVEs remaining unaddressed
  • Legacy systems with documented vulnerabilities

Example Exploitation: Pentester identifies unpatched Windows server with EternalBlue vulnerability, exploits using Metasploit, gains SYSTEM-level access, dumps credentials, and compromises additional systems.

3. Web Application Vulnerabilities (Found in 70%+ of Web App Pentests)

OWASP Top 10 Findings:

  • SQL Injection: Database compromise through input manipulation
  • Cross-Site Scripting (XSS): Client-side code injection
  • Broken Authentication: Session hijacking, credential bypass
  • Security Misconfigurations: Default settings, verbose errors
  • Broken Access Control: Unauthorized data or function access
  • CSRF: Cross-Site Request Forgery attacks

Example Exploitation: SQL injection in login form allows authentication bypass and database extraction of customer data including payment information.

4. Network Security Misconfigurations (Found in 50%+ of Pentests)

Common Misconfigurations:

  • Overly permissive firewall rules
  • Unnecessary services exposed to internet
  • Weak SSL/TLS configurations
  • Missing network segmentation
  • Insecure remote access configurations
  • Exposed administrative interfaces

Example Exploitation: Internet-facing RDP service with weak credentials enables initial access, lack of network segmentation allows unrestricted lateral movement.

5. Information Disclosure (Found in 60%+ of Pentests)

Common Leaks:

  • Detailed error messages revealing system internals
  • Directory listings exposing sensitive files
  • Backup files accessible via web
  • Source code exposure
  • Version information in banners
  • Comments in HTML containing sensitive data

Example Exploitation: Error message reveals database structure, directory listing exposes backup file containing credentials, which enables administrative access.

6. Inadequate Encryption (Found in 45%+ of Pentests)

Common Problems:

  • Unencrypted HTTP instead of HTTPS
  • Weak cipher suites and protocols (SSLv3, TLS 1.0)
  • Missing certificate validation
  • Cleartext credential transmission
  • Weak encryption algorithms

Example Exploitation: Man-in-the-middle attack on unencrypted login captures credentials in cleartext, enabling account compromise.

7. Social Engineering Vulnerabilities (15-25% Success Rate)

Common Successes:

  • Phishing emails resulting in credential disclosure
  • Pretexting phone calls extracting sensitive information
  • Physical tailgating into facilities
  • USB drop attacks with malware execution
  • Impersonation gaining unauthorized access

8. Cloud Misconfigurations (Found in 75%+ of Cloud Pentests)

Common Issues:

  • Publicly accessible S3 buckets or storage accounts
  • Overprivileged IAM roles and policies
  • Missing encryption on data stores
  • Exposed API keys and secrets
  • Insecure container configurations
Finding Category Prevalence Typical Severity Common Impact
Authentication Issues 65%+ High-Critical Unauthorized access
Missing Patches 55%+ High-Critical System compromise
Web App Vulnerabilities 70%+ Medium-Critical Data breach
Misconfigurations 50%+ Medium-High Increased exposure
Information Disclosure 60%+ Low-Medium Reconnaissance aid
Weak Encryption 45%+ Medium-High Data interception

Talk to a SubRosa security engineer

Get a straight answer on where your defenses actually stand. No pitch, no obligation.

Book a consultation

What to Do After a Pentest

The pentest report is just the beginning, taking action on findings is what actually improves security:

Step 1: Schedule Findings Presentation

  • Meet with pentesting team for detailed walkthrough
  • Ask questions about unclear findings
  • Request demonstrations of critical vulnerabilities
  • Discuss remediation priorities and approaches
  • Understand business impact of each finding

Step 2: Prioritize Remediation

Prioritization Framework:

  1. Critical/High + Critical Assets: Immediate action (within 7-15 days)
  2. Critical/High + Standard Assets: High priority (within 30 days)
  3. Medium + Critical Assets: Medium priority (within 60 days)
  4. Medium + Standard Assets: Standard priority (within 90 days)
  5. Low Severity: Address as resources permit or accept risk

Prioritization Factors:

  • Vulnerability severity (CVSS score)
  • Asset criticality and data sensitivity
  • Ease of exploitation
  • Potential business impact
  • Compensating controls in place
  • Remediation complexity and effort

Step 3: Develop Remediation Plan

  • Assign ownership for each vulnerability
  • Set realistic remediation timelines
  • Plan testing for patches and changes
  • Schedule maintenance windows
  • Allocate necessary resources
  • Establish progress tracking mechanisms

Step 4: Execute Remediation

Remediation Approaches:

  • Patching: Apply vendor security updates
  • Configuration Changes: Harden security settings
  • Code Fixes: Remediate application vulnerabilities
  • Compensating Controls: Add protective measures when direct fixes aren't possible
  • Architecture Changes: Implement network segmentation or redesigns

Step 5: Verification and Re-testing

  • Test that fixes effectively address vulnerabilities
  • Verify fixes don't introduce new issues
  • Request pentester re-testing for critical findings
  • Document successful remediation
  • Update vulnerability tracking systems

Step 6: Document and Learn

  • Conduct internal lessons learned session
  • Update security policies and procedures
  • Enhance security awareness training with findings
  • Improve change management processes
  • Strengthen security architecture based on discoveries
  • Create automated detections for attack techniques observed

Step 7: Plan Next Pentest

  • Schedule annual or semi-annual pentests
  • Expand scope to cover new systems
  • Consider different pentest types or approaches
  • Budget for ongoing security assessments
  • Track improvement over time
Remediation Reality: Organizations typically remediate 60-80% of critical and high-severity findings within 90 days. Perfect remediation is rare, focus on addressing vulnerabilities representing genuine business risk rather than attempting to fix every finding regardless of context.

Pentest Compliance Requirements

Many regulatory frameworks mandate regular pentesting:

PCI DSS (Payment Card Industry)

Requirement 11.3: Implement penetration testing at least annually and after significant changes.

Specific Requirements:

  • External penetration testing annually
  • Internal penetration testing annually
  • Testing after significant infrastructure or application changes
  • Testing by qualified internal resources or external third parties
  • Exploitation of vulnerabilities to validate security
  • Remediation and re-testing of critical issues

HIPAA (Healthcare)

HIPAA Security Rule requires regular security evaluations including technical testing.

Requirements:

  • Regular technical security evaluations
  • Testing of security controls effectiveness
  • Vulnerability identification procedures
  • Documentation of testing and findings

SOC 2 (Service Organization Controls)

SOC 2 audits often include pentesting as evidence of effective security controls.

Common Expectations:

  • Annual penetration testing
  • Scope covering in-scope systems
  • Documentation of findings and remediation
  • Independent testing by qualified assessors

ISO 27001

Annex A.12.6: Technical vulnerability management including testing.

Best Practices:

  • Regular security testing of systems
  • Risk-based testing frequency
  • Response to vulnerability disclosures
  • Documentation of methodology and results

NIST Cybersecurity Framework

NIST CSF recommends regular security testing as part of protective and detective controls.

Relevant Functions:

  • PR.IP-12: Vulnerability plan developed and implemented
  • DE.CM-8: Vulnerability scans performed
  • Regular penetration testing recommended
Framework Frequency Required Key Focus
PCI DSS Annual minimum External + internal pentests
HIPAA Regular intervals Technical evaluations
SOC 2 Annual recommended Control validation
ISO 27001 Risk-based Security testing
NIST CSF Regular basis Vulnerability identification

Compliance-Ready Pentesting

subrosa delivers pentests meeting PCI DSS, HIPAA, SOC 2, and other compliance requirements with audit-ready documentation and comprehensive reporting.

Ensure Pentest Compliance

Pentesting Best Practices

Maximize pentest value and effectiveness through these best practices:

Before the Pentest

1. Define Clear Objectives

  • What are you trying to achieve? (compliance, security validation, risk assessment)
  • What assets are most critical to protect?
  • What specific concerns do you have?
  • What compliance requirements must be met?

2. Determine Appropriate Scope

  • Include all internet-facing systems for external pentests
  • Cover representative internal systems for internal pentests
  • Include all user-facing applications
  • Don't over-scope initially, focused testing is often more valuable
  • Clearly define out-of-scope items

3. Prepare Your Environment

  • Backup critical systems before testing
  • Document baseline configurations
  • Ensure monitoring systems are operational
  • Coordinate with IT and security teams
  • Prepare credentials if white/grey box testing

4. Set Realistic Expectations

  • Pentests will likely find vulnerabilities, that's the point
  • Not all findings may be immediately fixable
  • Pentests provide snapshot in time, not ongoing protection
  • Budget time for remediation, not just testing

During the Pentest

1. Maintain Communication

  • Establish regular check-ins with pentesting team
  • Designate point of contact available during testing
  • Respond promptly to pentester questions
  • Be available for escalation of critical findings

2. Monitor for Issues

  • Watch for performance degradation
  • Monitor system availability
  • Review security alerts (are they detecting pentester activity?)
  • Be prepared to pause testing if problems occur

3. Learn from the Process

  • Observe how security controls respond to attacks
  • Note what monitoring systems detect (and miss)
  • Identify response capability gaps
  • Use pentest as security team training opportunity

After the Pentest

1. Take Findings Seriously

  • Treat report as actionable intelligence, not criticism
  • Focus on learning and improvement
  • Avoid defensive reactions to findings
  • Use discoveries to strengthen security

2. Act Quickly on Critical Findings

  • Address critical vulnerabilities within days, not weeks
  • Implement temporary mitigations while permanent fixes are developed
  • Don't delay remediation waiting for perfect solutions

3. Track and Measure Progress

  • Create tickets for each finding
  • Track remediation status and timelines
  • Measure improvement between pentests
  • Report progress to executives and stakeholders

4. Leverage Findings Broadly

  • Security Awareness: Use findings for training examples
  • Policy Updates: Update policies based on discoveries
  • Architecture Review: Address systemic security issues
  • Detection Engineering: Create alerts for attack techniques observed

Conclusion: Making Pentesting Part of Your Security Strategy

Pentesting, penetration testing, has evolved from an optional security exercise to a fundamental requirement for organizations serious about cybersecurity. With 60% of breaches involving exploitable vulnerabilities, waiting for attackers to discover your weaknesses is not a viable strategy. Pentesting provides the realistic, adversarial assessment needed to understand actual security posture beyond what security tools and compliance checklists suggest.

The investment in professional pentesting, typically $5,000 to $100,000+ depending on scope, represents a fraction of the average $4.45 million breach cost. Beyond financial considerations, pentests meet compliance requirements, validate security investments, provide stakeholder assurance, and identify the highest-priority security improvements for focused investment.

Effective pentesting requires careful planning, qualified security professionals with demonstrated expertise, clear scope and objectives, and, most importantly, organizational commitment to addressing identified vulnerabilities. A pentest that identifies critical vulnerabilities but results in no remediation action provides zero security value. The true benefit comes from the cycle of testing, learning, fixing, and retesting that creates measurable security improvement over time.

Organizations should establish regular pentesting cadences, at minimum annually, with additional testing after significant infrastructure changes or application updates. Compliance frameworks like PCI DSS mandate this frequency, but security best practices support even more frequent testing for high-risk environments or rapidly changing infrastructures.

As you implement or enhance your pentesting program, remember that security is continuous, not a destination. Each pentest provides a snapshot in time, identifies current weaknesses, and informs security improvements. Combined with vulnerability management, security monitoring, incident response capabilities, and security awareness training, regular pentesting creates the layered defense necessary to protect against evolving threats.

subrosa's pentesting services deliver comprehensive security assessments from certified professionals with decades of combined experience. We follow industry-leading methodologies, provide detailed actionable findings, support remediation efforts, and partner with organizations to demonstrate measurable security improvement over time. Whether you need PCI DSS compliance pentests, comprehensive application security assessments, or full red team engagements, our team provides the expertise to strengthen your security posture.

Professional Pentesting by subrosa

Discover your vulnerabilities before attackers do. subrosa's certified pentesters provide thorough assessments with actionable recommendations.

Schedule Your Security Assessment

Frequently Asked Questions

What is a pentest?
A pentest (penetration test) is an authorized simulated cyberattack against your systems, networks, or applications to identify exploitable security vulnerabilities. Professional pentesters, ethical hackers, use the same tools, techniques, and methodologies as real attackers to discover weaknesses before malicious actors can exploit them. The goal is to validate security controls, identify risks, and provide actionable remediation guidance to strengthen security posture.
How much does a pentest cost?
Pentest costs typically range from $5,000 to $100,000+ depending on scope, complexity, and duration. Small external network pentests cost $5,000-$15,000, web application pentests $8,000-$30,000, internal network assessments $10,000-$30,000, and comprehensive enterprise pentests $40,000-$150,000+. Factors affecting cost include number of systems/applications, testing duration, tester experience level, testing approach (black/white/grey box), and urgency. Most mid-sized organizations spend $15,000-$40,000 annually on pentesting.
How long does a pentest take?
Pentest duration varies by scope and type: basic external network pentests take 3-7 days, internal network assessments 5-10 days, web application pentests 5-14 days, mobile app pentests 7-14 days, and comprehensive enterprise pentests 4-12 weeks. This includes all phases: reconnaissance, vulnerability analysis, exploitation, post-exploitation assessment, and report preparation. Timelines should allow sufficient time for thorough assessment, rushed pentests miss vulnerabilities and provide false security confidence.
What are the types of pentests?
Main pentest types include network pentesting (external and internal infrastructure security), web application pentesting (website and web service vulnerabilities), mobile application pentesting (iOS/Android app security), wireless pentesting (WiFi and Bluetooth security), social engineering testing (human vulnerability assessment through phishing, pretexting, etc.), physical pentesting (facility and physical security controls), and cloud pentesting (AWS/Azure/GCP configuration security). Organizations often combine multiple types, such as external network + web application, for comprehensive security assessments.
How often should you conduct pentests?
Most organizations should conduct pentests at least annually as baseline security validation. Additional pentesting should occur after significant infrastructure changes (major upgrades, architecture changes), major application updates or new application deployments, security incidents or breaches, new compliance regimes, or when significant new vulnerabilities are disclosed affecting your environment. High-risk industries (financial services, healthcare, critical infrastructure) may require quarterly or semi-annual assessments. PCI DSS explicitly mandates annual external and internal pentests at minimum.
What's the difference between a pentest and vulnerability scan?
Vulnerability scanning is automated identification of potential security weaknesses by comparing systems against vulnerability databases, it answers "what vulnerabilities might exist?" Pentesting is manual simulation of real attacks attempting to exploit vulnerabilities to demonstrate actual impact, it answers "can vulnerabilities be exploited and what damage is possible?" Scanning is faster, broader, and cheaper; pentesting is deeper, validates exploitability, and proves business impact. Both are complementary: scan continuously for known issues, pentest periodically to validate real-world security effectiveness.
What certifications should pentesters have?
Top pentesting certifications include OSCP (Offensive Security Certified Professional), widely considered the gold standard for hands-on pentesting skills, CEH (Certified Ethical Hacker), GPEN (GIAC Penetration Tester), GWAPT (GIAC Web Application Penetration Tester) for web security specialists, CREST certifications (UK-based but internationally recognized), and PNPT (Practical Network Penetration Tester). Always verify pentesters hold relevant certifications and ask for proof. Experience matters too, look for 3-5+ years of actual pentesting work beyond certifications.
Is pentesting legal?
Pentesting is legal ONLY when performed with explicit written authorization from system owners. Unauthorized pentesting violates computer crime laws including the Computer Fraud and Abuse Act (CFAA) and similar international statutes, potentially resulting in criminal charges, fines, and imprisonment. Professional pentesters always obtain formal written permission, define clear rules of engagement specifying allowed activities, document authorization thoroughly, and maintain legal protections through contracts and liability insurance. Never conduct pentesting without explicit authorization.
What's included in a pentest report?
Comprehensive pentest reports include executive summary for business stakeholders (high-level findings and risk overview), detailed methodology explaining testing approach and scope, vulnerability findings with severity ratings (CVSS scores), proof-of-concept screenshots or videos demonstrating exploitability, detailed technical descriptions of each vulnerability, business impact analysis for findings, prioritized remediation recommendations with specific guidance on how to fix, strategic security recommendations for long-term improvements, and technical appendices with detailed exploit information, tools used, and supporting evidence.
Can pentests cause system damage or downtime?
While rare with professional pentesters, pentests can potentially cause issues if vulnerable or misconfigured systems crash during exploitation attempts or stress testing. Professional pentesters mitigate risks through: careful scoping to avoid business-critical systems during peak times, using safe exploitation techniques, maintaining constant communication channels, having rollback procedures ready, testing during agreed maintenance windows, avoiding production databases, and immediately notifying clients of any issues. Risks are documented in rules of engagement, and experienced pentesters prioritize preventing disruption while thoroughly testing security.
Do I need a pentest if I already have vulnerability scans?
Yes. Vulnerability scans identify potential vulnerabilities but don't validate exploitability or demonstrate real-world impact. Pentesters manually exploit vulnerabilities, chain multiple weaknesses together, and show actual business consequences, capabilities automated scanners lack. Scanners generate false positives and miss logical flaws, while pentesters validate genuine risks. Think of scanning as your annual physical exam finding potential issues, and pentesting as specialized diagnostic testing proving whether those issues actually threaten your health. Both are necessary for comprehensive security.
What should I do if a pentest finds critical vulnerabilities?
For critical findings: 1) Request immediate escalation and details from pentesting team, 2) Assess actual business impact and exposure, 3) Implement temporary mitigations or compensating controls immediately (disable services, restrict access, enhance monitoring), 4) Prioritize permanent fixes within 7-15 days maximum, 5) Test fixes thoroughly but quickly, 6) Request pentester verification that remediation is effective, and 7) Document incident and improvements for future prevention. Critical vulnerabilities warrant emergency change procedures and may require executive notification depending on exposure.
Should pentesting be done by internal staff or external providers?
Both have advantages. External pentesters offer fresh perspectives, specialized expertise, independence, compliance credibility, and no internal biases. Internal teams provide organizational knowledge, ongoing availability, potentially lower costs, and deeper understanding of business context. Best practice: use external providers for annual comprehensive assessments and compliance-required pentests, and internal teams (if qualified) for continuous testing, remediation validation, and targeted assessments. External perspective is particularly valuable for objective security assessment.
What's the difference between pentest and red team exercise?
Pentests are time-bound assessments with defined scope identifying as many vulnerabilities as possible within constraints. Red team exercises are extended adversary simulations testing detection and response capabilities with specific objectives (steal data, disrupt operations) using any means necessary, often without defensive team knowledge. Pentests answer "what vulnerabilities exist?" Red teams answer "can we detect and respond to sophisticated attacks?" Pentests are broader; red teams are deeper and more stealthy. Most organizations start with pentests before advancing to red team exercises.
How do I prepare my organization for its first pentest?
Preparation steps: 1) Secure executive approval and budget, 2) Define clear scope and objectives, 3) Select qualified pentesting provider with relevant certifications and experience, 4) Obtain formal authorization from all system owners, 5) Notify relevant stakeholders (IT, security, legal, management), 6) Coordinate testing timeline avoiding critical business periods, 7) Backup critical systems, 8) Establish communication channels and escalation procedures, 9) Prepare environment (credentials if white/grey box, documentation if needed), and 10) Set realistic expectations with stakeholders about likely findings and remediation requirements. Good preparation ensures smooth testing and maximizes value.
What happens to the pentest report after it's delivered?
Pentest reports contain sensitive security information and should be handled carefully: store securely with access controls limiting to need-to-know personnel, never email unencrypted reports, share specific findings only with teams responsible for remediation, redact sensitive details before broader distribution, maintain reports for compliance documentation, destroy or securely delete obsolete reports per retention policies, and never post publicly or share externally without sanitizing. Pentest reports are invaluable to attackers, treat them as highly confidential with proper security controls throughout their lifecycle.
View all