Pentesting

A company rarely knows exactly how secure its computers and programs really are. That is why, in pentesting, it hires professionals who try to break into its own systems. These professionals proceed exactly like criminals: they look for flaws in programs, guess passwords, or trick employees. The difference is that they are explicitly commissioned and are not allowed to break anything. In the end, they deliver not damage but a report listing all the vulnerabilities they found. The name comes from the English “penetration test”.

Why companies voluntarily let themselves be attacked

Security vulnerabilities are almost always already there before anyone notices them. The only question is who finds them first. If a pentester finds them, it costs a few days of work and an invoice. If a criminal group finds them, the result is often stolen customer data or encrypted servers. A ransomware attack regularly paralyzes mid-sized companies for weeks.

On top of that, there is legal pressure. In Europe, banks, hospitals, and power grid operators must prove that they regularly check their systems. Anyone who processes credit card payments also needs regular tests. Pentesting is therefore not just technology, but often also an obligation towards authorities and auditors.

An important point is often overlooked: a pentest doesn’t just check the technology. It also checks whether the defenders within the company even notice the attack. If a tester moves around the company network undetected for three days, that is a result in its own right. It shows that monitoring failed, regardless of the specific vulnerability.

From the contract to the report

It all starts with a contract that precisely defines what may be tested. It states which servers and applications are targets and which are off-limits. This boundary is called the scope. Without it, the test would simply be a crime, since breaking into someone else’s systems is a punishable offense.

The testers then gather information: which programs are running, which versions, which access points exist from outside. After that, they look for known flaws in exactly those versions. If an initial breach succeeds, they try to spread further and gain higher privileges. This process is called privilege escalation: a normal user account becomes an administrator account with full access.

A distinction is made based on the testers' level of knowledge. In a black-box test, they only get the company name, just like a real attacker from outside. In a white-box test, they receive access credentials and the source code and thus find significantly more. Related, but not the same, is an automated vulnerability scan: it only lists known problems, while a pentester actually exploits and combines them.

Pentesting in the news and in tools

The term appears in almost every report about data leaks. It’s often said that a pentest had already reported the vulnerability months earlier, without anyone responding. Bug bounty programs work in a similar way: companies like Google pay rewards to anyone who reports flaws. The difference is that a pentest is commissioned and time-limited, while a bug bounty is permanently open.

Professionally, this is its own field. Anyone working as a pentester usually needs certifications that require cracking real systems over several hours. The tools are freely available and are also used in schools and universities, though only in isolated practice networks.

New is the role of artificial intelligence. Language models now help search program code for flaws and suggest attack steps. At the same time, AI systems themselves are becoming test targets. This involves checking, for instance, whether a chatbot can be talked into giving forbidden information through cleverly worded prompts. This special form is called red teaming and is a fixed part of development at major AI providers.