active penetration

In an active penetration, commissioned security experts attempt to deliberately break into a computer system. They act like real attackers — using the same tools and tactics — but with explicit authorization from the system operator. The goal is not damage, but discovery: What gaps exist, and how bad would they be in a real-world scenario? At the end, the experts record in writing what they found and how to fix it. Such an engagement has a clear beginning and a clear end — it is not ongoing operation, but a targeted assessment.

Why companies commission active penetration testing

Many security vulnerabilities remain invisible as long as no one actively searches for them. Automated scans — programs that check a system for known vulnerabilities — only find what they already know. A human tester thinks around corners: they combine several small weaknesses into a dangerous attack path that no scan would recognize.

Added to this is legal pressure. In the financial and healthcare sectors, regulators in many countries require regular security audits. A passed penetration test is often a prerequisite for certifications such as ISO 27001 or for compliance with data protection laws. Anyone who fails to carry one out risks not only a breach, but also fines.

Phases of a penetration test

A penetration test proceeds in clearly defined steps. First, the client and tester determine what may be tested — which systems, at what times, with what methods. This document is called the scope and legally protects both sides. Then comes the reconnaissance phase: the tester gathers publicly available information about the target, for example from company websites or freely accessible databases.

After that, the actual attack begins. The tester attempts to break into systems, crack passwords, or deceive employees with fake emails — a method called phishing, in which the message is made to appear as if it comes from a trustworthy source. At the end, there is a final report with a list of all discovered vulnerabilities, ranked by severity, along with concrete recommendations for remediation.

Important: the tester does not try to cause as much damage as possible. They document a vulnerability as soon as they have demonstrated it, and do not fix it themselves — that is the company’s responsibility.

Active penetration in practice and in the news

Large technology companies such as Google or Microsoft operate their own internal teams for such tests. In addition, there are specialized security firms that offer penetration testing as a service. Some companies go a step further and run so-called bug bounty programs: anyone — including outside individuals without a contract — may search for vulnerabilities and receive a reward if they report one.

In the news, the term often appears in the aftermath of major data breaches. Investigators then determine that an exploited vulnerability had already been discovered during an earlier penetration test but was never fixed. This shows that the test alone does not provide protection — what matters is that the vulnerabilities found are actually closed afterward.

There is a risk of confusion with the term “vulnerability scan,” i.e., an automated scan for weaknesses. The scan lists potential problems, but a human does not verify whether they are actually exploitable. Active penetration goes further: it proves, through an actual attack, whether a vulnerability becomes dangerous in a real attack scenario.