Written by the Infronest Security Research Team — certified practitioners (CEH, OSCP, GPEN, ISO 27001 Lead Auditor) with 10+ years of hands-on delivery across banking, SaaS, healthcare and manufacturing. Methodology references PTES, NIST SP 800-115 and the OWASP Testing Guide v4.2. Statistics attributed to IBM, Gartner and MarketsandMarkets.
Security & Compliance
What Is Penetration Testing? A Complete Guide (2026)
The definitive explainer on penetration testing: a plain-English definition, the five phases of a real engagement, black/grey/white-box models, testing types by target, how it differs from vulnerability scanning, who is qualified to run one, realistic cost and duration, and what a pen test report should contain.
Penetration testing is the single most misunderstood line item in most IT security budgets. Teams buy it because an auditor asked for it, receive a 60-page PDF, and are never quite sure whether they got an adversarial security test or an automated scan with a consultancy logo on the cover. The difference matters commercially: IBM's Cost of a Data Breach Report 2025 puts the global average breach at USD 4.44 million, Gartner forecasts global information security spending of USD 244.2 billion in 2026, and MarketsandMarkets projects the penetration testing market alone will reach USD 4.39 billion by 2031 at a 14.2% CAGR. This guide explains exactly what penetration testing is, how a real engagement runs, what it should cost, and how to tell a good test from an expensive one.
Definition
What is penetration testing?
Penetration testing (also called pen testing, or a pen test) is an authorised, simulated cyber attack against a computer system, network, application or cloud environment, performed by security professionals to find weaknesses and actively exploit them before a real attacker does. Where a scanner reports that a door appears to be unlocked, a penetration test opens the door, walks through it, and documents exactly what is inside.
The word 'authorised' is load-bearing. A legitimate engagement begins with written permission from the asset owner, a defined scope (specific IP ranges, domains, applications and accounts), and rules of engagement covering test windows, prohibited actions such as denial-of-service, and escalation contacts. Performing the identical technical activity without that authorisation is a criminal offence — in India under the Information Technology Act, 2000, and under equivalent computer-misuse legislation elsewhere.
The deliverable is not a list of theoretical weaknesses. It is a demonstrated attack path. A typical finding does not read 'outdated software detected on host 10.0.4.19'; it reads 'an unauthenticated attacker on the guest Wi-Fi chained an exposed development interface with credentials reused from a public repository to obtain domain administrator rights in 4 hours 20 minutes'. That distinction is why penetration testing costs more than scanning and why boards act on it.
Business case
Why organisations run penetration tests
Most organisations commission their first test for a compliance or customer-driven reason and keep commissioning them for an operational one. Both motives are legitimate, and it is worth being explicit about which one you are buying against, because it changes the scope you should ask for.
- Prioritisation, not inventory — over 11,000 CVEs were published by March 2026. No team can patch everything. A pen test shows which weaknesses are actually reachable and chainable in your environment, which is a far shorter list than your scanner's.
- Compliance mandates — PCI DSS v4.0 requires an annual penetration test (Requirement 11.4) in addition to quarterly scanning; ISO/IEC 27001:2022 Annex A 8.8 and 8.26 cover technical vulnerability management and application security testing; SOC 2 auditors accept pen test reports as CC7 evidence. In India, RBI and SEBI cyber-security frameworks require periodic VA/PT for regulated entities, and certain filings must be signed off by a CERT-In empanelled auditor.
- Commercial due diligence — enterprise procurement and security questionnaires routinely ask for a penetration test report from the last 12 months. Not having one delays deals; having a weak one invites follow-up questions.
- Validating detection and response — a good engagement answers a second question beyond 'can we be breached': did anyone notice? If the SOC raised no alert while a tester escalated to domain admin, that is a more valuable finding than any individual CVE.
- Reducing breach exposure — with the global average breach at USD 4.44 million (IBM, 2025), a single validated and remediated attack path can pay for years of testing. This is an argument for regular testing, not a guarantee of prevention.
- Change validation — cloud migrations, new APIs, acquisitions and major releases all reset your attack surface. Testing after significant change catches configuration drift that annual-cycle testing misses.
Methodology
The five phases of a penetration test
Formal methodologies — PTES, NIST SP 800-115 and the OWASP Testing Guide v4.2 — differ in vocabulary but describe the same arc. Pre-engagement scoping and legal authorisation precede phase one; nothing technical starts until scope and rules of engagement are signed.
- 1. Reconnaissance — the tester builds a picture of the target without touching it aggressively: DNS and subdomain enumeration, certificate transparency logs, archived pages, public code repositories, breached-credential dumps, job adverts revealing internal technology, and employee data for social-engineering scenarios. Output: a target map that is usually larger than the client expected.
- 2. Scanning and enumeration — active discovery: port and service scanning, version fingerprinting, automated vulnerability scanning, web crawling, parameter and endpoint discovery, and manual validation to strip out false positives. Output: a prioritised list of candidate weaknesses worth attacking.
- 3. Exploitation — the tester attempts real compromise: SQL injection, authentication bypass, insecure deserialisation, default or reused credentials, server-side request forgery, known CVEs with working exploits, and business-logic abuse. Every successful exploit is captured as evidence — request/response pairs, screenshots, command output. Output: confirmed footholds with proof.
- 4. Post-exploitation — the phase that separates a pen test from a scan. From an initial foothold the tester escalates privileges, moves laterally, hunts credentials in memory and file shares, and demonstrates what data could be reached. Persistence is established only if in scope, and always documented for clean-up. Output: an attack narrative and a measured blast radius.
- 5. Reporting and retest — findings are written up with CVSS scores, reproduction steps, evidence and specific remediation guidance, then presented in a technical debrief. After your team fixes the issues, a retest verifies the fixes held and did not introduce new problems. Output: an audit-ready report and a retest attestation.
Scope
Types of penetration testing: by knowledge and by target
Two independent choices define any engagement. First, how much information the tester is given. Second, what is being tested. Get both wrong and you pay for the wrong test — for example, commissioning a black-box external test when your actual risk is an over-permissioned internal Active Directory.
- Black box — the tester starts with nothing but a company name or a domain. Most realistic simulation of an external attacker, but a meaningful share of the budget is spent on discovery rather than depth. Best for validating perimeter exposure and detection capability.
- Grey box — the tester receives partial information: standard user credentials, an architecture overview, or API documentation. This is the most commonly commissioned model because it delivers the best coverage per rupee — you skip the reconnaissance tax without losing adversarial realism.
- White box — full disclosure: source code, architecture diagrams, admin credentials, configuration. The most thorough option and the best choice for a security-critical application or a pre-release review, since the tester can reason about logic flaws directly rather than inferring them.
- Network penetration testing — external (internet-facing perimeter: VPN gateways, mail, exposed management interfaces) and internal (assume-breach from inside the LAN, typically targeting Active Directory, segmentation and lateral movement). Wireless and physical/social-engineering assessments are usually scoped as add-ons here.
- Web application penetration testing — authenticated and unauthenticated testing against the OWASP Top 10 and beyond: injection, broken access control, authentication and session flaws, IDOR, and business-logic abuse such as price or workflow manipulation.
- API penetration testing — increasingly the highest-value target, because APIs expose business logic directly. Focus areas are broken object-level authorisation, excessive data exposure, missing rate limits and weak token handling. A web app test does not automatically cover the APIs behind it — scope them explicitly.
- Mobile application penetration testing — static and dynamic analysis of Android and iOS builds: insecure local storage, hardcoded secrets, certificate pinning bypass, and the backend APIs the app depends on.
- Cloud penetration testing — identity and entitlement misconfiguration, over-permissive IAM roles, public storage, exposed metadata services and weak tenancy boundaries. Note that AWS, Azure and GCP each publish rules on what customer-run testing is permitted against their infrastructure.
Comparison
Penetration testing vs vulnerability scanning
A vulnerability scan is automated, broad and repeatable. It compares software versions and configurations against a signature database and returns everything that matches — typically hundreds of findings for a mid-size environment, with a meaningful false-positive rate. It answers 'what weaknesses might exist?' and it should run continuously or at least weekly.
A penetration test is human-led, narrow and deep. It answers 'what can an attacker actually do?' Scanners cannot find broken object-level authorisation, privilege-escalation chains across three otherwise-low-severity issues, or a checkout flow that accepts a negative quantity — because none of those have a signature. Conversely, no tester should be billed at consultancy rates to do what a scanner does better and cheaper.
The honest recommendation is to run both, sequenced: continuous automated scanning for coverage and patch verification, plus a human-led penetration test annually, after major change, and where compliance requires it. When the two are delivered as one structured engagement with remediation and retest, the market usually calls it VAPT.
Compare vulnerability assessment and penetration testing in detail →
Practicalities
Who performs a pen test, what it costs, and what you get back
Penetration testing is a skilled trade with no universal licence, so credentials and sample work are your main quality signals. Cost figures below are indicative market ranges for planning purposes, not quotes — always take three proposals and compare scope, tester days and deliverables rather than headline price.
- Who runs it — an in-house offensive security team (rare below roughly 1,000 employees), a specialist consultancy, or a PTaaS provider delivering testing through a platform. Indian regulated entities filing with RBI, SEBI or sector regulators frequently need a CERT-In empanelled auditing organisation, so confirm empanelment before you sign.
- Certifications to look for — OSCP is the practical baseline for a network or infrastructure tester; OSWE and OSEP indicate advanced application and evasion skill; CREST CRT/CCT and GIAC GPEN/GWAPT are widely respected; CEH is a knowledge-level entry credential rather than proof of hands-on ability. Always ask for named tester CVs and a redacted sample report before signing.
- Typical duration — a single web application: 3–5 testing days plus 2–3 reporting days. An external network of a few hundred hosts: 3–5 days. An internal Active Directory assessment: 5–10 days. A multi-scope enterprise engagement covering network, applications, APIs and cloud: 3–6 weeks. A retest normally takes 1–3 days.
- Typical cost — in India, a focused web application test commonly falls in the INR 1.5–4 lakh range, and a combined mid-size network plus application engagement in the INR 5–15 lakh range. Comparable engagements in the US and Western Europe typically run USD 8,000–35,000, with enterprise multi-scope programmes running well beyond that.
- The clearest red flag — a fixed-price 'penetration test' delivered in under two days for a complex environment is almost always an automated scan with a consultancy cover page. Ask directly how many human tester days the price buys.
- Report, part one — an executive summary written for non-technical leadership: overall risk rating, count of findings by severity, what an attacker could realistically achieve, and the three to five actions that matter most. This is the section your board and your customers will actually read.
- Report, part two — full technical findings, each with a description, CVSS v3.1 or v4.0 base score, affected assets, step-by-step reproduction instructions, proof-of-concept evidence (screenshots or command output), and specific remediation guidance rather than a generic 'apply vendor patches'.
- Report, part three — the attack narrative walking through the compromise chain in sequence, the methodology and scope statement your auditor will check, and a retest attestation letter once fixes are verified. Findings without evidence are opinions; insist on evidence.
Infronest
Conclusion
Infronest does not replace a penetration tester's toolkit — Burp Suite, Nmap, Metasploit and a skilled human remain the tools of the trade, and any vendor claiming otherwise is overselling. What Infronest's Security & VAPT module does is manage the programme around the testing: creating engagements, recording findings with CVSS scores, attaching proof-of-concept evidence, routing findings through peer review, generating audit-ready PDF reports, and tracking remediation and retest status so nothing quietly stays open between annual cycles.
Because it sits in the same tenant-isolated workspace as your IT asset register, patch management, MDM, helpdesk and monitoring modules, a finding can be traced to the asset it affects and the ticket that fixes it, rather than living in a spreadsheet detached from operations. Consultancies and MSPs use it to keep each client's engagement data fully separated with its own audit trail. Start a 14-day free trial at infronest.com — no credit card required.
Sources and standards referenced
- IBM — Cost of a Data Breach Report 2025 (global average breach cost USD 4.44 million)
- Gartner — worldwide information security spending forecast, USD 244.2 billion for 2026
- MarketsandMarkets — penetration testing market forecast, USD 4.39 billion by 2031 at 14.2% CAGR
- CVE Program / NVD — over 11,000 CVEs published by March 2026
- Methodology standards: PTES, NIST SP 800-115, OWASP Testing Guide v4.2
- Compliance references: PCI DSS v4.0 Requirements 11.3 and 11.4; ISO/IEC 27001:2022 Annex A 8.8 and 8.26; CERT-In empanelment for Indian regulated audits
Frequently Asked Questions
- What is penetration testing in simple terms?
- Penetration testing is a controlled, authorised cyber attack on your own systems, performed by security professionals who try to break in the same way a criminal would. Instead of just listing weaknesses, they exploit them to prove what an attacker could actually reach. The result is a report showing the real attack paths into your environment and exactly how to close them.
- What is the difference between penetration testing and vulnerability scanning?
- A vulnerability scan is automated and broad: it matches your software versions and configurations against a known-issue database and returns a long list of possible weaknesses. A penetration test is human-led and deep: a tester chains weaknesses together, exploits them, and demonstrates real business impact. Scanners cannot find logic flaws such as broken access control or a checkout that accepts a negative quantity, which is why most organisations run both.
- How often should a penetration test be performed?
- Annually is the baseline that most compliance frameworks expect, including PCI DSS v4.0 for in-scope environments. You should also test after any significant change — a cloud migration, a new public API, a major release, or an acquisition — because each of those resets your attack surface. Continuous vulnerability scanning should run in between; a yearly pen test alone leaves an eleven-month blind spot.
- How much does a penetration test cost in India?
- As an indicative planning range, a focused web application penetration test in India commonly falls between INR 1.5 lakh and 4 lakh, and a combined mid-size network plus application engagement between INR 5 lakh and 15 lakh. Price should be compared on human tester days and deliverables, not headline figures. Any fixed-price test completed in under two days for a complex environment is almost certainly an automated scan rather than a genuine penetration test.
- Is penetration testing legal?
- Yes, provided it is authorised in writing by the owner of the systems being tested, with an agreed scope and rules of engagement. Without that authorisation the same technical activity is a criminal offence under India's Information Technology Act, 2000 and equivalent computer-misuse laws elsewhere. If you are testing assets hosted on AWS, Azure or GCP, also check each provider's published customer testing policy before starting.