Penetration Testing Methodology: The 7 Stages of a Professional Pentest

A penetration test is an authorized, simulated cyberattack that follows a repeatable seven-stage methodology: pre-engagement and scoping, reconnaissance, vulnerability discovery, exploitation, post-exploitation, reporting, and remediation validation. Unlike a vulnerability scan, which only flags known issues, a pentest has an ethical hacker actively exploit and chain those weaknesses under written authorization to prove real business impact — then hands you a prioritized roadmap to close the gaps. The internationally recognized structure for this work is the Penetration Testing Execution Standard (PTES), reinforced by the OWASP Web Security Testing Guide for applications and NIST SP 800-115 for federal assessments.

That's the summary an AI gives you. Here's what it can't show: the actual sequence of the workflow, the decision points that separate a checkbox scan from a real attack simulation, and the concrete tools and payloads used at each stage. The animated diagram below maps the full lifecycle end to end, and the rest of this guide walks each stage with real commands, exploitation examples, and a report template you can hand to leadership.

What the Numbers Actually Support

Pages in this space routinely claim that some precise percentage of breaches "could be prevented by penetration testing." We have not found a credible source for any such figure, and we are not going to repeat one. No study isolates penetration testing as a variable well enough to produce that number, because organizations that run regular pentests differ from those that do not in dozens of other ways.

Here is what is actually measured, from IBM's Cost of a Data Breach Report 2026 (published July 2026, based on breaches at 600+ organizations):

Metric	2026 figure
Global average cost of a breach	$4.99 million — a record, up 12% year over year
United States average	$11.5 million — more than double the global figure
Average breach lifecycle	241 days (181 days to identify, 60 days to contain)
Savings for organizations using security AI and automation	$1.93 million, with lifecycles 65 days shorter

The honest case for penetration testing follows from the 241-day figure rather than from any prevention percentage. The gap between compromise and detection is where the cost accumulates — IBM attributes nearly two-thirds of total breach cost to detection and escalation plus lost business. A penetration test does not prevent a breach on its own; what it does is surface exploitable paths before an attacker uses them, and validate whether your detection and response actually fire when someone walks those paths. That second function is why the deconfliction guidance later in this guide matters: if you whitelist the tester's IPs, you have bought a vulnerability list and learned nothing about your 181-day detection gap.

Set against a test that typically costs $5,000-$30,000 (see the verified 2026 cost ranges), the economics are straightforward without needing an invented statistic.

7 Stages of Professional Penetration Testing

From pre-engagement planning to remediation validation, here's the complete penetration testing methodology used by security professionals worldwide.

Pre-Engagement

& Scoping

Define test objectives, document rules of engagement, establish legal authorization, and build communication plans before testing begins.

Reconnaissance

& Intelligence Gathering

Collect intelligence about target systems through OSINT, DNS enumeration, subdomain discovery, and technology stack identification.

Vulnerability Discovery

& Analysis

Perform automated vulnerability scanning, manual verification, business logic testing, and risk scoring using CVSS methodology.

Exploitation

& Access

Demonstrate real-world impact by exploiting identified vulnerabilities—SQL injection, XSS, RCE, and network-level vulnerabilities.

Post-Exploitation

& Privilege Escalation

Simulate attacker persistence through privilege escalation, lateral movement, credential harvesting, and data exfiltration.

Reporting

& Client Presentation

Deliver executive summary for leadership plus detailed technical findings with remediation guidance for security teams.

Remediation Validation

& Retesting

Verify fixes actually work by retesting all critical vulnerabilities and validating security improvements.

Stage 1: Pre-Engagement & Scoping

Professional penetration testing begins weeks before the first scan runs. Pre-engagement establishes legal protection, defines scope boundaries, documents testing constraints, and aligns expectations.

Define Test Objectives & Scope

Work with stakeholders to understand business context, compliance requirements (PCI-DSS, HIPAA, SOC 2), and risk tolerance. Define exactly what will be tested: external penetration test simulating internet attackers, internal network assessment assuming breach, web application security testing following OWASP methodology, API security testing for REST/GraphQL endpoints, or cloud infrastructure assessment.

Document in-scope assets explicitly: IP ranges, domain names, web applications, cloud resources, and credentials. Use tools to enumerate attack surface:

• Certificate Transparency Lookup - Discover all subdomains via CT logs
• DNS Lookup - Enumerate DNS records and identify services
• WHOIS Lookup - Verify domain ownership and registration details

Just as important: document what's OUT of scope. Third-party hosted services, production databases (unless explicitly approved), legacy systems scheduled for decommission, and customer data environments should be clearly excluded.

Establish Rules of Engagement

Rules of Engagement (RoE) protect both tester and client. Obtain written authorization from someone with legal authority to approve testing. Document allowed testing techniques (port scanning, vulnerability scanning, password attacks, exploitation) and explicitly prohibited activities (denial of service, data deletion, social engineering without approval).

Define testing windows: Will testing occur 9-5 Monday-Friday or 24/7 to simulate realistic attack conditions? Document blackout periods (holiday freezes, end-of-quarter processing, tax season). Establish communication plan with primary contact, technical contact, and emergency escalation hotline for critical findings.

Use Incident Response Playbook Generator to create emergency response procedures if testing accidentally triggers production incidents.

Choose Testing Methodology

Select testing approach based on objectives:

Black Box Testing: Zero prior knowledge simulating external attacker. Tester discovers everything through reconnaissance. Tests external defenses and detection capabilities. Longer timeline but most realistic threat simulation.

Gray Box Testing: Partial knowledge provided (user credentials, network diagrams). Balances realism with efficiency. Typical for internal network assessments and web application testing.

White Box Testing: Full knowledge (source code, architecture docs, credentials). Most thorough coverage in shortest timeline. Ideal for secure code review and pre-production validation.

	Black Box	Gray Box	White Box
Knowledge given	None	Partial (creds, diagrams)	Full (source, architecture)
Simulates	External attacker	Malicious insider / phished user	Trusted reviewer
Coverage depth	Shallow-to-medium	Medium-to-deep	Deepest
Timeline / cost	Longest, priciest	Balanced	Shortest per unit of coverage
Best signal for	Perimeter + detection	Internal blast radius	Code-level flaws
Which should I use?	Proving you can be breached from the internet	The common default for internal network & web-app tests	Pre-production release gating and secure code review

Most real engagements are gray box: pure black box burns budget on reconnaissance the defender already knows, and pure white box tells you nothing about whether your detection works. Reach for black box when the deliverable is board-level "can we be breached from the outside," and white box when you're gating a release.

Stage 2: Reconnaissance & Intelligence Gathering

Reconnaissance builds comprehensive attack surface map before active testing. Professional penetration testers "think like an attacker" by collecting intelligence about target systems, technologies, and potential vulnerabilities.

Passive Reconnaissance (OSINT)

Gather intelligence WITHOUT directly interacting with target systems—completely undetectable and legal since all information is publicly available.

Domain & DNS Intelligence:

• DNS Lookup - Enumerate DNS records (A, MX, TXT, NS) to identify mail servers, nameservers, and email security (SPF, DKIM, DMARC)
• WHOIS Lookup - Domain registration details, expiration dates, administrative contacts
• Certificate Transparency Lookup - Discover ALL subdomains including forgotten dev/staging environments

Example CT log discovery often reveals hidden attack surface:

Primary Domain: example.com

Discovered Subdomains:
✓ www.example.com (Production)
✓ api.example.com (REST API)
⚠️ dev.example.com (Development - often weak security)
⚠️ staging.example.com (Staging - potential outdated code)
⚠️ old-app.example.com (Abandoned - likely unpatched)

Search Engine Reconnaissance: Use advanced Google operators to find accidentally exposed information:

• site:example.com filetype:pdf - Find documents with metadata
• site:example.com inurl:admin - Locate admin panels
• site:example.com "confidential" - Find leaked internal documents
• site:github.com "example.com" "password" - Search for leaked credentials

Employee Intelligence: LinkedIn reconnaissance reveals organizational structure, technology stack (job postings mention Docker, Kubernetes, AWS), and potential social engineering targets.

Active Reconnaissance

Active reconnaissance directly interacts with target systems to enumerate services and identify attack vectors.

Port Scanning: Identify all open ports and services using Nmap. Reference Port Reference to understand discovered services—Port 22 (SSH credential attacks), Port 3389 (RDP brute force), Port 445 (SMB vulnerabilities like EternalBlue), exposed database ports 3306 (MySQL) or 5432 (PostgreSQL).

Use Subnet Calculator to calculate network ranges from CIDR notation and plan scanning strategies for large networks.

Web Application Mapping:

• Security Headers Analyzer - Identify missing security headers and misconfigurations
• robots.txt Analyzer - Find disallowed paths revealing admin panels, API endpoints, backup directories

Robots.txt often announces sensitive directories to attackers:

User-agent: *
Disallow: /admin/
Disallow: /.git/
Disallow: /backup/

⚠️ These paths are NOT protected—robots.txt only announces their existence

Email Infrastructure Assessment

Email security assessment identifies phishing attack vectors:

• Check SPF records (validate authorized email senders)
• Verify DKIM (email signing enabled)
• Analyze DMARC policy (should be p=quarantine or p=reject, not p=none)

Weak email security enables phishing campaigns and email spoofing. Use DNS Lookup to check email authentication records and identify security gaps.

Stage 3: Vulnerability Discovery & Analysis

Vulnerability discovery identifies exploitable weaknesses through automated scanning and manual verification. Professional penetration testing goes far beyond running scanners—manual testing finds business logic flaws and complex attack chains that tools miss.

Automated Vulnerability Scanning

Use industry-standard scanners for baseline vulnerability assessment:

Network Scanning: Nessus, OpenVAS, or Rapid7 Nexpose scan all systems for known vulnerabilities, missing patches, and misconfigurations. Authenticated scans (with credentials) find 90% more vulnerabilities than unauthenticated scans.

Web Application Scanning: Burp Suite Professional or OWASP ZAP test for OWASP Top 10 vulnerabilities—SQL injection, cross-site scripting (XSS), authentication bypass, authorization flaws (IDOR), XML external entity (XXE) injection, server-side request forgery (SSRF), and insecure deserialization.

Configure scans with safe checks enabled (prevent DoS), bandwidth throttling (prevent network saturation), and schedule during off-peak hours for production environments.

Manual Vulnerability Verification

Scanners produce 30-40% false positives. Manual verification separates real vulnerabilities from false alarms:

Scanner Finding: SQL Injection in /search?q=test

Manual Verification:
1. Reproduce finding (inject ' OR '1'='1)
2. Observe behavior (error message, delay, changed output)
3. Attempt data extraction (UNION-based SQLi)
4. Confirm database access achieved
5. Document proof-of-concept with screenshots

Result: ✓ CONFIRMED - Critical vulnerability validated

Authentication & Authorization Testing

Test authentication strength and access controls:

Password Attacks: Password spraying (common passwords against many accounts), credential stuffing (leaked credentials from breach databases), brute force attacks. Test account lockout policies—do 10 failed attempts trigger lockout?

Multi-Factor Authentication Bypass: Can MFA be disabled after setup? Can API endpoints bypass MFA requirements? Are TOTP codes reusable?

Authorization Flaws (IDOR): Change ID parameters to access other users' data:

Vulnerable: GET /api/invoices/12345
Attack: GET /api/invoices/12346
Result: Access OTHER USER's invoice

Impact: All 50,000 customer invoices accessible

Privilege Escalation: Can regular users access admin functions by sending requests directly to admin endpoints?

Input Validation Testing

Test for injection vulnerabilities:

SQL Injection: Inject malicious SQL to bypass authentication, extract data, modify database contents, or delete data. Use payloads like ' OR '1'='1, UNION-based extraction, and time-based blind SQLi.

Cross-Site Scripting (XSS): Inject JavaScript to steal session cookies, perform actions as victim, or deface pages. Test reflected XSS (payload in URL), stored XSS (payload saved in database), and DOM-based XSS (client-side JavaScript vulnerability).

Command Injection: Inject operating system commands through vulnerable inputs like ping utilities or file processing features. Test payloads like ;cat /etc/passwd or &&whoami.

Server-Side Request Forgery (SSRF): Force server to make requests to internal systems:

Vulnerable: POST /upload {"url": "https://example.com/image.jpg"}
Attack: POST /upload {"url": "http://169.254.169.254/latest/meta-data/"}
Result: AWS metadata exposed (credentials compromised)

Cryptographic Testing

Assess encryption implementation:

• SSL Certificate Scanner - Test for weak cipher suites, deprecated TLS versions (1.0, 1.1), certificate validity
• X.509 Certificate Decoder - Decode certificate details and verify trust chain
• Hash Generator - Identify weak hashing algorithms (MD5, SHA1) in password storage

Check for missing security headers (HSTS prevents protocol downgrade attacks).

Vulnerability Risk Scoring

Use CVSS (Common Vulnerability Scoring System) v3.1 to quantify risk:

CVSS Score Ranges:

• Critical (9.0-10.0): Immediate remediation required
• High (7.0-8.9): Remediate within 30 days
• Medium (4.0-6.9): Remediate within 90 days
• Low (0.1-3.9): Remediate opportunistically

Example scoring: SQL Injection in login form = CVSS 10.0 (Critical)—Network attack vector, low complexity, no privileges required, changed scope, high impact to confidentiality/integrity/availability.

Stage 4: Exploitation & Access

Exploitation demonstrates real-world impact by actively attacking identified vulnerabilities. Ethical hackers exploit weaknesses with client authorization to prove business risk—authentication bypass accessing customer data, remote code execution compromising servers, or privilege escalation gaining administrative control.

Web Application Exploitation

SQL Injection: Extract database credentials, enumerate table structures, dump user accounts with password hashes, and attempt hash cracking:

-- Extract credentials
' UNION SELECT username, password_hash FROM users--

Result:
admin:$2b$12$N9qo8uLO... (bcrypt hash)
john.doe:$2b$12$8Kqp4pLM...

-- Crack hashes using Hashcat
Result: admin password cracked: "Welcome2024!"

XSS to Session Hijacking: Inject JavaScript payload to steal session cookies when admin views attacker's profile. Use stolen cookie to impersonate admin and access administrative functions.

File Upload Vulnerability: Bypass client-side validation by intercepting request and changing filename from malicious.php.jpg to malicious.php. Upload webshell to execute arbitrary commands: <?php system($_GET['cmd']); ?>

Network-Level Exploitation

SMB Exploitation (EternalBlue): Exploit MS17-010 vulnerability in unpatched Windows systems using Metasploit Framework to gain SYSTEM-level access on file servers.

SSH Credential Attacks: Use Hydra for password spraying against SSH services. Common default credentials often work: admin/admin123, root/password, backup/backup2024.

Database Exploitation: Test default credentials on exposed databases—MySQL root/(no password), PostgreSQL postgres/postgres, MongoDB (no authentication by default). Successful access = full database compromise affecting hundreds of thousands of customer records.

Password Cracking

Once password hashes are extracted, use GPU-accelerated cracking:

Tool: Hashcat with rockyou.txt wordlist

Results:
- Total hashes: 150
- Cracked: 45 (30% success rate)
- Common patterns: Welcome[Year], Password[Number], [Season][Year]

Use Hash Generator to identify hash types before attempting to crack them.

Stage 5: Post-Exploitation & Privilege Escalation

Post-exploitation simulates what happens AFTER initial compromise—attackers don't stop at first access. They escalate privileges from regular user to administrator, move laterally across networks, dump credentials, and demonstrate data exfiltration capability.

Privilege Escalation (Linux)

SUID Binary Exploitation: Find SUID binaries that execute with root privileges. Misconfigured binaries like find with SUID bit allow instant root access:

find /etc/passwd -exec /bin/bash -p \;

Result: Root shell obtained
uid=1000(john) euid=0(root)

Kernel Exploits: Identify outdated kernel versions and exploit known vulnerabilities (CVE-2021-4034 PwnKit, CVE-2022-0847 Dirty Pipe) for privilege escalation.

Sudo Misconfigurations: Check sudo -l for dangerous permissions. Users allowed to run vim or nano with sudo can spawn root shells.

Privilege Escalation (Windows)

Unquoted Service Paths: Windows services with spaces in paths but no quotes allow attackers to place malicious executables in path resolution order:

Service: C:\Program Files\Custom Application\service.exe
Exploit: Place malicious.exe at C:\Program Files\Custom.exe
Result: Malicious code executes with SYSTEM privileges

AlwaysInstallElevated: Registry misconfiguration allowing users to install MSI packages with SYSTEM privileges. Create malicious MSI installer to gain full administrative control.

Token Impersonation: Service accounts with SeImpersonatePrivilege can be exploited using tools like PrintSpoofer to obtain SYSTEM privileges.

Lateral Movement

Pass-the-Hash: Use captured NTLM hashes to authenticate to other systems without knowing cleartext password. Move laterally across network using Impacket's psexec to access file servers, database servers, and workstations.

Credential Reuse: Password reuse across systems allows single compromised credential to grant access to 10+ additional servers.

BloodHound Analysis: Use BloodHound to map Active Directory attack paths from compromised user account to Domain Admin:

Attack Path:
John (Compromised)
  → Member of "Help Desk" group
  → "Help Desk" has GenericWrite on "SQL Admins"
  → "SQL Admins" has AdminTo on SQLSERVER01
  → SQLSERVER01 has Domain Admin session
  → Compromise Domain Admin

Credential Dumping

LSASS Memory Dump: Use Mimikatz to extract credentials from Windows memory—25 accounts harvested including 3 Domain Admin accounts.

Kerberoasting: Request service tickets for SPN accounts and crack Kerberos tickets offline to obtain service account passwords.

NTDS.dit Extraction: On Domain Controller, extract Active Directory database containing ALL domain password hashes—complete Active Directory compromise with 5,000+ user hashes.

Data Exfiltration Simulation

Demonstrate data theft capability (proof-of-concept only):

# Search for sensitive data
grep -r "password" /home/* 2>/dev/null
find / -name "*.pem" -o -name "*.key" 2>/dev/null

# Database access
mysql -h localhost -u root -p'SuperSecret123!'
SELECT COUNT(*) FROM customers;
Result: 500,000 customer records at risk

# Stage for exfiltration (simulated)
mysqldump customer_db > customer_data.sql
tar -czf exfil_data.tar.gz customer_data.sql

CRITICAL: Ethical penetration testers document exfiltration capability but DO NOT actually steal data.

Stage 6: Reporting & Client Presentation

Professional penetration testing delivers two distinct reports—Executive Summary for business leadership focused on risk and business impact, and Technical Findings for security/IT teams with detailed exploitation steps and remediation guidance.

Executive Summary

Business leaders need to understand risk, not technical details:

Overall Security Posture: Rate current security (A-F grading). Example: "D (Poor) - Critical vulnerabilities allow complete network compromise."

Critical Findings Summary:

• Finding 1: SQL Injection enabling customer database compromise (500K records)
• Finding 2: No Multi-Factor Authentication allowing credential-based attacks
• Finding 3: Unpatched systems vulnerable to ransomware (EternalBlue)

Business Impact Quantification:

• Estimated breach cost: $15M-$35M (data breach, regulatory fines, reputation damage)
• Remediation cost: $150K-$250K
• ROI: 6,000%-23,000%

Compliance Impact:

• PCI-DSS: FAILING (merchant account at risk)
• GDPR: HIGH RISK (potential €20M fine)
• SOC 2: FAILS (customer contracts at risk)

Immediate Actions (0-30 days):

1. Patch SQL injection vulnerability (Finding 1)
2. Deploy Multi-Factor Authentication (Finding 3)
3. Apply critical Windows patches (15 systems)
4. Rotate all compromised credentials

Technical Findings

Security teams need detailed technical information:

Per-Vulnerability Template:

• Severity: CRITICAL (CVSS 9.8)
• Affected Asset: https://portal.example.com/login
• Technical Details: Vulnerable code inferred, exploitation proof-of-concept
• Proof of Concept: Step-by-step reproduction instructions with screenshots
• Impact: Confidentiality/Integrity/Availability assessment
• CVSS Score: Complete vector string and scoring breakdown
• Remediation: Short-term emergency fix (WAF rule) + long-term permanent fix (parameterized queries)
• Validation: Retest steps to verify fix effectiveness

Include Code Examples:

# VULNERABLE CODE
query = "SELECT * FROM users WHERE username='" + username + "'"

# SECURE FIX (Parameterized Query)
cursor.execute("SELECT * FROM users WHERE username=?", (username,))

Remediation Roadmap

Provide prioritized remediation plan:

Phase 1: Emergency Response (0-7 days)

• Deploy WAF rules
• Disable vulnerable features temporarily
• Rotate compromised credentials
• Apply critical patches

Phase 2: Critical Remediations (8-30 days)

• Implement code fixes for injection vulnerabilities
• Deploy Multi-Factor Authentication
• Fix privilege escalation vulnerabilities

Phase 3: High Priority (31-90 days)

• Network segmentation
• Security awareness training
• Logging and monitoring (SIEM deployment)

Phase 4: Medium/Low Priority (91-180 days)

• Security headers implementation
• Certificate management automation
• Incident response planning

Total investment: $300K over 6 months to reduce breach risk by 95% and avoid $15M-$35M breach costs.

Stage 7: Remediation Validation & Retesting

Remediation validation verifies that fixes actually work. Clients remediate critical vulnerabilities, then penetration testers retest to confirm vulnerabilities are properly closed without introducing new issues.

Validation Testing

SQL Injection Validation:

Original Exploit: username=admin' OR '1'='1'--
Original Result: Authentication bypassed (VULNERABLE)

Validation Test 1: Authentication bypass attempt
Result: ✅ Login failed - Invalid credentials

Validation Test 2: UNION-based injection
Result: ✅ Data extraction prevented

Validation Test 3: Time-based blind SQLi
Result: ✅ No delay observed

Code Review: ✅ Parameterized queries confirmed

Finding Status: ✅ VERIFIED FIXED

XSS Validation:

Original Exploit: <script>alert('XSS')</script>
Original Result: JavaScript executed (VULNERABLE)

Validation Test 1: Script tag injection
Result: ✅ Output encoded (&lt;script&gt;)

Validation Test 2: Event handler XSS
Result: ✅ Event handlers escaped

Validation Test 3: CSP header verification
Result: ✅ CSP restricts inline scripts

Finding Status: ✅ VERIFIED FIXED

MFA Validation:

Test: Login with correct password only
Result: ✅ MFA prompt required (TOTP code)

Test: MFA bypass via API endpoint
Result: ✅ Blocked - MFA required

Test: User enrollment verification
Result: ✅ 100% MFA enrollment (500/500 users)

Finding Status: ✅ VERIFIED FIXED

Regression Testing

Ensure security fixes didn't break legitimate functionality:

Login System Regression:

• ✅ Valid username/password → Login successful
• ✅ Special characters in password → Works correctly
• ✅ Unicode characters → Handled properly

File Upload Regression:

• ✅ JPEG/PNG image upload → Successful
• ✅ PDF document upload → Successful
• ❌ PHP file upload → REJECTED (expected)

Result: No regressions—security fixes work without impacting legitimate users.

New Findings

Opportunistically identify NEW vulnerabilities introduced during remediation:

Finding 68: Overly Permissive CORS

New Issue: Access-Control-Allow-Origin: *
Severity: MEDIUM (CVSS 5.3)
Recommendation: Restrict CORS to specific origins
Status: NEW (introduced during API hardening)

Final Validation Report

Remediation Results:

• Critical Findings: 15/15 REMEDIATED (100%) ✅
• High Findings: 20/23 REMEDIATED (87%) ✅
• Medium Findings: 12/21 REMEDIATED (57%) ⏳
• Low Findings: 2/8 REMEDIATED (25%) ⏳

Security Posture Improvement:

• Original Rating: D (Poor)
• Current Rating: B+ (Good)
• Risk Reduction: 95%

Compliance Status:

• PCI-DSS: ✅ NOW COMPLIANT
• GDPR: ✅ RISK REDUCED 95%
• SOC 2: ✅ ON TRACK FOR CERTIFICATION

Next Steps:

1. Address 2 new findings identified during retest
2. Complete remediation of remaining medium findings
3. Schedule next annual penetration test
4. Continue quarterly security awareness training

Which Penetration Testing Methodology Should You Use?

"Penetration testing methodology" refers to two different things, and conflating them causes most of the confusion. It can mean the seven-stage process described above — the sequence any competent test follows. Or it can mean a named published standard that formalizes that process. The stages are largely universal; the standards differ in scope, prescriptiveness, and what they were written for.

Here is how the five that matter actually compare:

Standard	Maintained by	Covers	Prescriptiveness	Use it when
PTES	Community (Penetration Testing Execution Standard)	Full engagement lifecycle across all target types, in seven phases: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting	Medium — structures the engagement, leaves technique choice open	You want one framework for the whole engagement regardless of target type. This is the sensible default.
OWASP WSTG	OWASP Foundation	Web applications and APIs only. A deep technique catalog across information gathering, configuration, identity, authentication, authorization, session management, input validation, error handling, cryptography, business logic, and client-side testing	High on technique, silent on contracting	Your target is a web app or API and you need verifiable test-by-test coverage. Referenced directly by PCI DSS Requirement 6.5.
NIST SP 800-115	NIST (U.S. federal)	Technical security testing and assessment, including planning, execution, and post-execution. Notably formal about rules of engagement and authorization	High on process and documentation	You are a federal agency or contractor, need findings mapped to NIST SP 800-53 controls, or need the most defensible paper trail.
OSSTMM	ISECOM	Operational security measurement across five channels: human, physical, wireless, telecommunications, and data networks. Produces a quantified "attack surface" metric rather than a findings list	High, and unusually rigorous about measurement	You want repeatable, quantitative results you can trend over time, or your scope extends well beyond IT into physical and human channels.
MITRE ATT&CK	MITRE	Not a testing methodology — a knowledge base of real-world adversary tactics and techniques	Not applicable; it is a taxonomy	You want to map findings to real adversary behavior, run threat-informed or purple-team exercises, or communicate results to a detection team. Use it alongside a methodology, never instead of one.

What most professional engagements actually do: use PTES as the engagement skeleton, OWASP WSTG for the technique-level work inside any web or API target, NIST SP 800-115 language for the rules of engagement and authorization documentation, and MITRE ATT&CK to map findings to adversary behavior in the report. These are complementary. A firm that claims a "proprietary methodology" with no reference to any published standard is a red flag — it usually means the process is undocumented rather than innovative.

For how these standards differ specifically in their scoping, authorization, and rules-of-engagement requirements, see our guide to penetration test scope, rules of engagement, and authorization, which also covers verified 2026 cost ranges and how to compare competing proposals.

Industry Compliance Requirements

PCI-DSS: Requires annual external penetration test plus internal penetration test after significant infrastructure changes. Must test network segmentation between cardholder data environment and other networks.

HIPAA: Security Rule requires regular risk assessments and security testing to protect electronic protected health information (ePHI).

SOC 2: Penetration testing demonstrates security monitoring effectiveness and validates security controls under Trust Service Principles.

ISO 27001: Clause A.12.6.1 requires technical vulnerability management including regular security testing.

Frequently Asked Questions

How is penetration testing different from vulnerability scanning?

Vulnerability scanning is automated tool-based testing that identifies known vulnerabilities across your environment. Penetration testing is manual testing where ethical hackers actively exploit vulnerabilities to demonstrate real-world business impact. Vulnerability scanning finds potential issues; penetration testing proves actual risk. You need both: continuous vulnerability scanning for ongoing visibility and annual penetration testing to validate your defenses actually work under attack.

How often should we conduct penetration testing?

Most organizations conduct annual penetration testing to meet compliance requirements (PCI-DSS, SOC 2, ISO 27001). However, you should also test after significant infrastructure changes (cloud migration, new applications), before major product launches, after security incidents, or when entering new compliance frameworks. High-risk organizations (financial services, healthcare) often test quarterly or continuously through bug bounty programs.

Will penetration testing disrupt our business operations?

Professionally conducted penetration testing should not disrupt operations. We coordinate testing schedules around critical business periods, use safe scanning techniques (authenticated scans, no DoS attacks), and establish communication channels for immediate escalation if issues arise. Most customers never notice testing is occurring. For sensitive systems, we can schedule testing during maintenance windows or use staging environments.

What's the difference between black box, gray box, and white box testing?

Black box testing provides zero prior knowledge (simulates external attacker discovering everything through reconnaissance). Gray box testing provides partial knowledge like user credentials or network diagrams (balances realism with efficiency). White box testing provides complete knowledge including source code and architecture documentation (most thorough coverage). Gray box testing is most common for internal assessments, while black box testing simulates realistic external threats.

Do you actually exploit vulnerabilities or just identify them?

Yes, we actually exploit vulnerabilities (with your authorization) to demonstrate real-world business impact. This distinguishes penetration testing from vulnerability assessments. We'll bypass authentication to access customer data, gain administrative privileges through privilege escalation, move laterally across your network, and demonstrate data exfiltration capability. However, we operate ethically—we don't steal data, cause damage, or exceed agreed-upon scope. Every exploit is documented with proof-of-concept evidence.

What deliverables do we receive after penetration testing?

You receive two reports: Executive Summary for business leadership (overall risk rating, business impact, compliance status, recommended actions) and Technical Report for security/IT teams (detailed vulnerability findings, CVSS scores, proof-of-concept exploits, remediation guidance). We also provide prioritized remediation roadmap with timelines and cost estimates, plus remediation validation retesting after you've fixed critical vulnerabilities.

How long does penetration testing take?

Timeline varies by scope: small web application (1 week active testing), internal network assessment (2-3 weeks), comprehensive external and internal testing (3-4 weeks), red team engagement (4-8 weeks). Add 1-2 weeks for pre-engagement and 1-2 weeks for reporting. Total engagement typically spans 6-10 weeks from kickoff to final report delivery. Remediation validation retesting occurs 30-90 days later after you've fixed vulnerabilities.

What happens if you find critical vulnerabilities during testing?

Critical findings (CVSS 9.0+) are reported immediately via phone and email to your security team—we don't wait for final report. Examples include SQL injection accessing customer databases, remote code execution, or complete Active Directory compromise. We'll work with you to understand business impact, provide emergency remediation guidance (temporary WAF rules, disabling vulnerable features), and help prioritize permanent fixes.

Ready to Validate Your Security Defenses?

Get comprehensive penetration testing following PTES methodology to identify vulnerabilities before attackers exploit them. Schedule a consultation to discuss your security testing needs and compliance requirements.

Schedule Penetration Testing Consultation

No obligation - 30-minute call - Custom security testing recommendations