Penetration testing asks one question a scanner cannot: how far could someone get?

A tester is given permission and a scope, then behaves like an intruder. They look for weak points, try to exploit them, and use each foothold to go further. The result is evidence of real impact, not a list of possible problems.

A list of known flaws says little about consequence. A penetration test shows that a low-rated misconfiguration plus a guessable reset link can open another customer's account, and that is what boards, buyers and auditors want to know. NIST SP 800-115 describes four phases: planning, discovery, attack and reporting, with the attack phase feeding back into discovery as new access reveals more. Auditors under SOC 2 or ISO 27001 do not always demand a test, but your own controls often promise one, and payment-card rules require it outright.

Your security policy

A commitment such as an annual test of the production application and after major change.

SOC 2 or ISO 27001 evidence

The test report, the tracking of findings, and the retest that shows fixes held.

Customer security reviews

A request for a letter or executive summary from the latest test.

The rules of engagement

The signed document that authorises the test and fixes its limits.

Vulnerability scan

Automated and broad: it lists likely weaknesses. A penetration test is manual and deep: it proves which ones can be used, and how far.

VAPT

A combined engagement that includes a vulnerability assessment and a penetration test. Penetration testing is the exploitation half.

Red teaming

A longer, goal-driven exercise that also tests detection and response, often with few people told. A pen test aims for coverage of a defined scope.

• Define the scope by asset and by question: which application, which roles, and what you most fear an attacker reaching.
• Agree written rules of engagement before any testing begins.
• Ask for a report that shows reproduction steps, business impact and a severity rating for each finding.
• Budget for remediation and a retest, since the test alone fixes nothing.

• GuidePenetration testing for SOC 2What auditors look for in a test report, and what they ignore.
• GuidePenetration testing and ISO 27001What the standard expects, and what auditors accept.
• GuideSecurity testing servicesVulnerability assessment and penetration testing, scoped to what your buyers and auditors ask for.

Sources: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment; PCI SSC penetration testing guidance; OWASP Web Security Testing Guide.