A penetration test is an authorized attempt to break into your systems, carried out by security specialists who use the techniques an attacker would. Where a vulnerability scan lists what might be weak, a penetration test shows what can be reached and how far someone could get once inside. While these two phrases often get used interchangeably, they're very different and serve different purposes. In this article, our Red Team, the professionals who conduct both, break it all down.
Why Test Before an Attacker Does
Your patches are current and your vulnerability scans run on schedule, but the next step in securing your environment is being able to confidently answer whether it will hold up against someone actively trying to get around it. And while these used to be questions mostly asked inside your organization and by your security team, major cyber attacks in the headlines and new risks associated with AI mean you're likely getting more of these questions from customers, prospects, or even your board. A penetration test answers this question, though it runs inside a fixed window while an attacker can spend months moving through every device, server, and service until something gives.
“We have limited time. Attackers don't.”
– Trevor Kems, Cyberleaf Red Team
The stakes usually rise at a concrete moment, such as a new application going live or a customer or auditor asking for evidence that your defenses hold up. Many teams reasonably assume that anything inside a locked-down network is safe by default, but this isn't always the case and a penetration test shows whether that assumption holds.
A Penetration Test Runs in Four Steps
Step One: Outline the Scope
Scoping takes the longest, because many organizations are unsure how large their environment is or exactly what is running in it, and the red team works that out with them. Rough estimates are usually enough, as long as everyone knows whether the environment is closer to a hundred endpoints or a thousand.
Scope also covers how far testers should go and which systems are fragile, such as older servers or devices that cannot handle a heavy load. Leadership should authorize the scope of the penetration test before any testing begins. For internal testing, the team ships a pre-configured device for you to plug into your network, or works from a virtual machine you host, and tests remotely once you confirm the connection.
Step Two: Test and Exploit
Testing starts with reconnaissance, which means learning what an attacker can see before touching anything. Public maps and street imagery, office videos, badge photos that surface on social media, and internet scanners that can find a new server within an hour of it going online all feed into it. Vulnerability scans usually run alongside, because they speed up the search for weak points.
Exploitation follows under controlled conditions. When a tester gains access to a system, the next question is where that access leads, and post-exploitation measures the impact, including the access gained and how far it could spread. Credentials found on one machine get tried against Active Directory, and each new foothold sends the tester back to reconnaissance. The process loops several times in one engagement, which makes it look more like a circle than a straight line.
Step Three: Analyze and Report
Testers collect screenshots and other evidence throughout the engagement. The report ties each finding to its evidence and severity rating and explains how to fix it, with an executive summary for leadership and technical detail for the teams doing the work.
Step Four: Remediate and Retest
Your team works through the fixes using the prioritized guidance in the report or you can scope those fixes into your agreement with your cybersecurity partner. Though restesting is optional, it confirms that the fixes hold and that no new gaps have surfaced.
What a Penetration Test Can Cover
Area
|
What it examines
|
External
|
Internet-facing systems, domains, VPNs, and exposed services, and the paths an attacker could take in from the outside |
Internal and Active Directory
|
Starts from the assumption that an attacker already has a foothold, such as a phished account, and shows how far privileges, movement between systems, and identity paths could take them
|
Cloud and Microsoft 365
|
Cloud workloads, identity controls, permissions, MFA, and configuration weaknesses across Microsoft 365, Azure, Google Cloud, and AWS
|
Web applications and APIs
|
Authentication, authorization, business logic, input handling, and API abuse paths, including the APIs behind mobile apps
|
Wireless and mobile
|
Wireless exposure, rogue access point risk, and mobile application and device-level testing
|
Social engineering and red team
|
Phishing, phone calls (vishing), and text messages (smishing), plus physical testing or a broader attacker simulation when the client approves
|
How a Vulnerability Scan and a Penetration Test Differ
A vulnerability scan uses automated tools to check systems for known weaknesses, missing patches, and misconfigurations, and it can run on a schedule across a large environment. It covers a lot of ground and stops short of exploiting what it finds, so results need an analyst to confirm. A penetration test picks up where the scan stops, with testers trying to use each finding and following where it leads.
|
Vulnerability Scan
|
Penetration Test
|
How it works
|
Automated tools check for known vulnerabilities, missing patches, and misconfigurations
|
Manual and automated testing by security specialists who try to exploit findings and chain them together
|
What it tells you
|
What might be vulnerable across your environment
|
What an attacker could reach, how far they could move, and what to fix first
|
What it's best for
|
Everyday hygiene, patch management, and broad coverage on a schedule
|
Measuring risk, validating controls, and giving customers and auditors evidence
|
What you get
|
A list of potential findings, some needing analyst review
|
Evidence for exploited findings, mapped attack paths, prioritized fixes, and an executive summary with technical detail
|
We recommend both as you need vulnerability scanning and penetration testing to get a full picture of how your security program will hold up against attackers. The one-page guide linked below is a great comparison to take to your team.
How a Penetration Test Stays Safe for Your Systems
Testers work only inside the scope the client has agreed to in writing, since working outside it can carry legal consequences. Within that scope, testers avoid outages and data loss and handle only the data they need. They secure the evidence they collect and report findings accurately.
“The last thing we want is a client going down because of something we did.”
– Mike Lucas, Cyberleaf Red Team
Disruption can still happen, and when it does it is usually minor and tied to something fragile, such as an older server or a device that cannot handle the load, which is why scoping includes asking about those systems. If a test turns up a critical risk, signs that an attacker is already inside, or a scope that has become unclear, pen testers pause their work pauses and report it to the client right away.
What You Learn From a Penetration Test
A completed test shows which weaknesses can be exploited and how far someone could move once inside, so you know which fixes to make first. Some engagements are designed to be loud, testing whether your security team and tools noticed, while quieter ones show what an attacker could do without being caught. The report works as a to-do list for your team and a summary for leadership, and customers and auditors often ask to see that evidence.
How Cyberleaf Runs a Penetration Test
Cyberleaf's Red Team scopes the work with you and matches tools to your environment, pairing automated scanning with hands-on testing. Automation allows them to cover ground quickly so testers follow the findings that matter. Every engagement includes manual validation, attacker-minded testing, evidence-backed findings, executive and technical reporting, remediation guidance, and an optional retest. An engagement can start with a focused test of one surface and grow to cover several.
One team handles networks, cloud, web applications, wireless, mobile, and social engineering, so what turns up in one area can inform the next. Cyberleaf's team holds certifications including the Offensive Security Certified Professional (OSCP) and the Certified Penetration Testing Engineer (C)PTE).
A test suits organizations that need evidence for customers or auditors, or that are launching a new application or environment. If you are weighing whether one makes sense for you, a free half hour with one of our security practitioners is a good place to start.
Questions About Penetration Testing
Can a penetration test disrupt my systems?
Testers work to avoid outages, data loss, and destructive actions, and they stay inside the agreed scope. Disruption can happen, and when it does it is usually minor and tied to fragile systems such as older servers. Listing those systems during scoping lowers the risk.
How is a penetration test different from a vulnerability scan?
A scan uses automated tools to list potential weaknesses across your systems. A test tries to exploit what it finds and chain findings together, which shows what an attacker could reach.
What do I receive at the end?
A report with the evidence behind each finding, a severity rating, prioritized steps to fix it, and an executive summary alongside technical detail. A retest to confirm the fixes is optional.
As always, we’re here to be a resource for you and your team. If this raised a question about where your own organization stands, book a time with one of our security practitioners.
.png?width=95&height=125&name=Threat%20Report%20(1).png)
