Penetration testing (a pen test) is an authorized, simulated cyberattack against your systems, performed by security experts who use the same tools and techniques as real attackers to find security flaws that could actually be exploited. Where a vulnerability scan tells you a door might be unlocked, a pen test walks through it, sees what’s on the other side, and tells you how far an attacker could get. Businesses commission pen tests to satisfy compliance requirements (PCI DSS, SOC 2, CMMC, HIPAA), to meet cyber insurance and client demands, and, most usefully, to find out before an attacker does.
In this guide
- Pen testing vs. vulnerability assessment
- Types of penetration tests
- Black box, gray box, white box
- The penetration testing process
- What a pen test finds
- What penetration testing costs
- When you need a pen test
- How to choose a pen testing provider
- Common mistakes
- How Sixwatch handles penetration testing
- FAQ
- Glossary
Penetration testing vs. vulnerability assessment
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Method | Automated scanning | Manual testing by security experts, plus tools |
| Output | A list of known vulnerabilities, ranked by severity | Proof of what can actually be exploited and how far it leads |
| Depth | Broad and shallow | Narrow and deep |
| Frequency | Monthly or continuous | Annually, or after major changes |
| Cost | $500 – $5,000 / year, or included in managed security | $5,000 – $50,000+ per test |
| Answers | What weaknesses exist? | Can someone get in, and what would they get? |
You need both. Scanning finds the hundred unlocked windows. Pen testing shows which one leads to the vault. See our full guide to vulnerability assessments.
Types of penetration tests
| Type | What’s tested | Typical for |
|---|---|---|
| External network | Everything reachable from the internet: firewalls, VPNs, email, web servers, remote access | Every business; the most common first test |
| Internal network | What an attacker could do from inside: a compromised laptop, a malicious insider, a plugged-in device | Businesses with on-premises servers, Active Directory |
| Web application | Custom or hosted apps: injection, authentication, session, access control, and business logic flaws (OWASP Top 10) | SaaS companies, client portals, e-commerce |
| Cloud | Microsoft 365, Azure, AWS, Google Cloud configuration and identity | Nearly everyone now |
| Wireless | Wi-Fi security, rogue access points, guest network isolation | Offices, clinics, retail |
| Social engineering | Phishing, vishing, pretexting, physical entry attempts against employees | Businesses assessing the human layer |
| Physical | Can a tester walk into your server room? | Regulated facilities |
| Mobile application | iOS/Android apps and their APIs | App developers |
| Red team | A full simulated attack with a defined objective, testing detection and response as much as prevention | Mature security programs |
Black box, gray box, white box
- Black box: the testers get nothing but a company name or IP range, simulating an outside attacker. Most realistic, least efficient.
- Gray box: the testers get limited information, such as a standard user account, simulating a compromised employee or a phished credential. The best value for most internal tests.
- White box: full access to architecture, source code, and credentials. Most thorough; used for application and code-level testing.
Most business pen tests are black box externally and gray box internally.
The penetration testing process
- Scoping and rules of engagement. What’s in scope (IP ranges, applications, locations), what’s off limits, when testing happens, who to call if something breaks, and written authorization. Testing without this is illegal.
- Reconnaissance. Testers gather what an attacker could learn: exposed services, employee names, leaked credentials, technology in use.
- Scanning and enumeration. Identifying live systems, open ports, running services, and versions.
- Vulnerability identification. Matching what was found against known weaknesses and misconfigurations.
- Exploitation. Attempting to break in: exploiting vulnerabilities, brute force attacks on weak passwords, abusing misconfigurations, phishing if in scope.
- Post-exploitation. Once inside, how far can they go? Escalating privileges, moving laterally, reaching sensitive data, reaching backups.
- Reporting. An executive summary, each finding with severity, evidence, and a specific remediation, and an attack narrative showing how findings chain together.
- Remediation and retest. You fix the findings; the testers verify the fixes.
A typical external and internal test takes one to three weeks including reporting.
What a pen test typically finds
At small and mid-size businesses, the same findings appear repeatedly:
- Remote access (RDP, VPN, remote management tools) exposed without MFA
- Weak or reused passwords, often cracked within hours from a leaked hash
- Unpatched systems with publicly known exploits
- Default credentials on printers, cameras, and network gear
- Over-privileged accounts: every user a local admin, service accounts with domain admin
- Flat networks: from one workstation, everything is reachable
- Legacy protocols (SMBv1, NTLM relay) enabling lateral movement
- Cloud misconfigurations: public storage, missing conditional access, legacy authentication enabled
- Web application flaws: SQL injection, broken access control, weak session management
- Employees who click phishing links or hold the door for a stranger with a clipboard
The report’s real value is the chain: “weak password on the VPN → user account → misconfigured share containing admin credentials → domain admin → backups deleted.” That’s the story a ransomware group would write.
What penetration testing costs
| Test | Typical cost |
|---|---|
| External network (small business, under 50 IPs) | $5,000 – $12,000 |
| External + internal network | $10,000 – $25,000 |
| Web application (single app) | $8,000 – $30,000 |
| Cloud (Microsoft 365 / Azure) | $6,000 – $15,000 |
| Social engineering campaign | $4,000 – $12,000 |
| Wireless | $3,000 – $8,000 |
| Full red team engagement | $40,000 – $150,000+ |
| Retest | Often 10 – 25% of original, sometimes included |
Prices scale with the number of systems, the complexity, and the tester’s experience. Very cheap “pen tests” are usually rebranded vulnerability scans; ask whether manual exploitation is included.
When you need a penetration test
- Compliance requires it. PCI DSS requires annual pen tests and after significant changes. SOC 2 auditors expect one. CMMC Level 2 and HIPAA risk analyses effectively require it. See IT compliance.
- Cyber insurance asks. Increasingly a renewal question. See cyber insurance.
- A client asks. Enterprise procurement questionnaires often request the date and summary of your last test.
- After major changes. A new office, a cloud migration, a new application, a merger.
- You’ve never had one. Most businesses that have run for years without a pen test have at least one critical finding waiting.
- Annually, as a baseline, for any business with sensitive data.
How to choose a penetration testing provider
- Manual testing, not just tools. Ask what percentage of the engagement is hands-on exploitation.
- Tester credentials. OSCP, OSCE, GPEN, CREST, or equivalent, and experience with environments like yours.
- A sample report. It should tell a story, not dump scanner output. Findings should include reproduction steps and specific fixes.
- Scope clarity and rules of engagement in writing.
- Insurance. The provider should carry professional liability coverage for testing activities.
- Independence. If your MSP also runs your pen test, ask whether the testing team is separate from the team that built what’s being tested. Many businesses use their MSP for scanning and remediation and an independent firm for the annual test.
- Retest included or reasonably priced.
Common mistakes
- Buying a vulnerability scan labeled as a pen test.
- Scoping too narrow to get a clean report. The finding you excluded is the one that matters.
- Not fixing the findings. A report in a drawer is expensive paper.
- Testing once and never again. Environments change; new vulnerabilities appear monthly.
- No rules of engagement, leading to production outages or legal exposure.
- Excluding social engineering because “our people are good.” The report will say otherwise.
How Sixwatch handles penetration testing
Sixwatch coordinates penetration testing for managed cybersecurity clients across Tampa Bay and Cincinnati: scoping, working with independent testing partners for annual external and internal tests, and, most importantly, remediating the findings, which is where most businesses stall. Continuous vulnerability scanning runs between tests so new weaknesses don’t wait a year to be found.
Founder John Owens brings 25+ years of IT and security experience to reading the report and turning it into a fix list. Every managed plan includes a 30-minute emergency remote response and same-day onsite support, and our 5.0 Google rating includes clients whose second pen test came back clean.
Book a 15-minute call or request a proposal.
Frequently asked questions
What is penetration testing? An authorized, simulated attack on your systems by security experts to find and demonstrate exploitable weaknesses before a real attacker does.
What is the difference between a vulnerability scan and a penetration test? A scan is automated and lists known vulnerabilities. A pen test is manual, attempts exploitation, and shows how far an attacker could actually get.
How much does a penetration test cost? $5,000 to $25,000 for external and internal network testing at a small or mid-size business; more for applications, red teams, or large environments.
How often should you do a penetration test? Annually at minimum, plus after significant changes. PCI DSS and most compliance frameworks require at least annual testing.
Is penetration testing required for compliance? PCI DSS requires it explicitly. SOC 2, CMMC, HIPAA, and cyber insurers expect it as part of a reasonable security program.
Can a penetration test cause damage? Rarely, with proper scoping and rules of engagement. Reputable testers avoid destructive techniques on production systems and coordinate timing with you.
What are the three types of penetration testing? By tester knowledge: black box (no information), gray box (limited information), and white box (full information). By target: network, application, cloud, wireless, social engineering, and physical.
How long does a pen test take? One to three weeks for a typical external and internal engagement, including reporting.
Glossary
- Attack chain: The sequence of steps from initial access to objective.
- Exploit: Code or a technique that takes advantage of a vulnerability.
- Lateral movement: Moving from one compromised system to others.
- OWASP Top 10: The most critical web application security risks.
- Privilege escalation: Gaining higher access than initially obtained.
- Red team: A full adversary simulation testing detection and response.
- Rules of engagement: The written agreement defining scope, timing, and limits.
- Scope: The systems authorized for testing.
Never had a pen test, or fixed the findings from the last one? Book a 15-minute call · Request a proposal