Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Penetration testing methodology: how a professional test is scoped, run and reported

Category hub: Security tools and testing methods

In one sentence: A penetration testing methodology is the agreed plan for how a tester tries to break into your systems, what is allowed and how the results get reported.

What it is

A penetration test is a controlled attempt to breach a system, done with permission. The NCSC defines it as a method for gaining assurance in the security of an IT system by attempting to breach some or all of its security, using the same tools and techniques as an adversary might.

The methodology is the process around that: scope, how much the testers know in advance, which techniques are allowed, how findings are rated and how the report is delivered. The NCSC says testing is not a magic bullet and is assurance over your vulnerability management, not the main way to find vulnerabilities.

How it works

  1. Scope. Agree what is in and out: systems, dates and the risks of testing. If testers find something outside scope that affects it, the NCSC says they can suggest a scope change or record the exclusion as a limitation.
  2. Approach. The NCSC describes opaque or closed box tests, where testers start with little information, and transparent or open box tests, where full information is shared. Scenario-driven tests explore a situation such as a lost laptop.
  3. Reconnaissance. Testers map what is exposed.
  4. Analysis. They look for weaknesses and choose which to try.
  5. Exploitation. They try to use them, safely and within scope, to show real impact.
  6. Post-exploitation. They show how far an attacker could get from there.
  7. Report and debrief. The NCSC says a report should assess the risk of each vulnerability, and a debrief lets you ask questions.
  8. Fix and retest.

Who it affects and how badly

  • Sole trader to 10 staff. A full test may be more than you need unless a client or insurer asks.
  • 10 to 250 staff. SaaS start-ups, recruiters and accountancy practices are often asked for a test report. A poor scope makes it worthless.
  • 250 plus and regulated firms. Fintech, insurers, healthcare and telecoms may need testing for PCI DSS, SOC 2, ISO 27001, NIS2 or DORA, and regulators will ask to see results.

The NCSC notes a year or more can pass between tests, so weaknesses can sit unseen in between.

Real examples

  • The NCSC’s own guidance is the best public reference. It says a well-scoped test can give confidence that products and controls are configured to good practice and that there are no common or publicly known vulnerabilities in the tested components, at the time of the test.
  • Process quality. One provider-neutral buyer’s guide describes the usual sequence of reconnaissance, analysis, exploitation, post-exploitation and reporting. Treat this as opinion, not a standard. No client incidents are named.

How to detect it

Signs a test has been done well, and questions to ask when you buy one.
– Is the scope in writing, with exclusions and test accounts?
– Do named people do the work, rather than only tools?
– Does the report give evidence, plain explanations and a risk rating for each finding, not a dump of scanner output?
– Is there a debrief, and is a retest included?
– Could your alerts spot the testers?

How to fix or prevent it

How to get the most from a test.
1. Decide the goal first: a client request, a framework, a new system or a scenario.
2. Write a scope with exclusions and a named contact, and sign an authorisation.
3. Run vulnerability scanning and patching first, so the test is not spent on known issues.
4. Choose open or closed box to suit the goal.
5. Agree how critical findings are reported during the test.
6. Rank fixes by business risk. The NCSC says risk decisions stay with you.
7. Retest to confirm fixes, and keep the report for auditors and clients.

Related terms

FAQ

What is a penetration test?
The NCSC defines it as a method for gaining assurance in the security of an IT system by trying to breach it using the tools and techniques an adversary might.

Is a penetration test a replacement for vulnerability management?
No. The NCSC says it should be seen as assurance over your vulnerability management, not the primary way of finding vulnerabilities.

What is the difference between open box and closed box testing?
In open or transparent box tests the testers are given full information. In closed or opaque box tests they start with little.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.