What Is Penetration Testing?
Penetration testing is an authorized, simulated attack on an application, network or system to find vulnerabilities and prove they can be exploited before a real attacker does. Testers chain weaknesses together and report what they reached, with evidence.
Also known as:
How Penetration Testing Works
A penetration test follows a scoped plan agreed in advance, including which systems are in bounds, which techniques are allowed and when testing happens. Most engagements move through the same stages.
- Reconnaissance. Map the attack surface: hosts, endpoints, roles and technologies.
- Discovery. Look for weaknesses such as injection points, broken access control or misconfiguration.
- Exploitation. Attempt to use those weaknesses safely, often chaining several together.
- Reporting. Document each finding with impact, evidence and remediation guidance.
Types of Penetration Tests
- Black box. The tester starts with no internal knowledge, like an outside attacker.
- Gray box. The tester has partial knowledge, such as a normal user account.
- White box. The tester has source code, architecture details and credentials.
Tests are also grouped by target, such as web applications, APIs, cloud environments, internal networks and mobile apps.
Why Penetration Testing Matters
Scanners report what might be wrong. A penetration test shows what an attacker can actually do, which is why it is the clearest way to separate theoretical findings from real risk. Many compliance programs also expect it. PCI DSS, for example, requires internal and external penetration testing at least once every 12 months and after significant changes.
Point-in-Time vs Continuous Testing
A traditional penetration test is a snapshot. It reflects the application on the day it was tested and starts to go stale as soon as new code ships. Continuous testing runs the same attacker workflow on an ongoing basis, so new endpoints and changes are tested as they appear instead of waiting for the next annual engagement.
How Nullify Approaches Penetration Testing
Nullify's AI pentest agent continuously and autonomously attacks REST and GraphQL APIs with active, multi-stage exploitation. Each exploit is independently re-reviewed before it is reported, with request and response pairs, screenshots and video as evidence. Single-page and server-rendered apps are covered separately through Bug Hunts. See how the Nullify AI pentest agent works.
Key Takeaways
- A penetration test is an authorized attack that proves which vulnerabilities can actually be exploited.
- Engagements move from reconnaissance to discovery, exploitation and reporting.
- Point-in-time tests go stale as code changes, which is why continuous testing is growing.
- Only test systems you own or are explicitly authorized to test.
Read More About Penetration Testing
AI Pentest Agent
See Nullify in Action
Nullify attacks your APIs continuously and reports only exploits it can prove.