What a pentest is and how it differs from a vulnerability scanner

A pentest, or penetration test, is a controlled attack on your systems with the owner's permission. The goal is not to "find everything" but to show what an attacker with a given level of access can really do, and how long it would take.

Why it is not a scanner

A vulnerability scanner checks systems against a database of known issues and produces a list of hundreds of lines, most of which threaten nobody. A pentester takes those same findings and verifies them by hand: whether something can actually be done through them, whether two "low" issues combine into one critical, whether data leaks where the scanner sees nothing, for example in business logic.

Three access modes

• Black box: we know only the address, like an external attacker.
• Grey box: we have a regular user account, like an insider or a customer.
• White box: we have code, diagrams and access, so we find the most in the least time.

What you get

A report with every finding: evidence, steps to reproduce, CVSS risk level and the business impact in plain words, a recommendation on how to fix it. Plus a retest after the fixes to confirm the holes are closed.

When a pentest is needed

• Before launching a new product or a major release.
• After an incident or a suspected leak.
• For ISO 27001, SOC 2 certification or partner requirements.
• Once a year as hygiene for systems that handle money or personal data.