Penetration testing explained for non-experts

Short version: a penetration test is a controlled, authorised attack on your own product. Specialists try to break in the way a real attacker would, then hand you a report ranking what they found by severity, with fixes. It's not the same as an automated scan — the value is human creativity and chained weaknesses. Get one before you launch something that holds real customer data, and repeat it after major changes.

"We should probably get a pen test" is one of those phrases that circulates in founder conversations without much shared understanding of what it involves. Here is the non-expert version, without the mystique.

What actually happens

You hire a security firm. You agree the scope in writing — which systems they may test, when, and what's off-limits. They then spend a defined period (often a week or two) trying to get in: probing your login flows, your APIs, your permissions model, your infrastructure. Everything is logged. At the end you get a report, usually followed by a call to walk through it.

The crucial difference from an automated scan is imagination. A scanner tells you a library is out of date. A tester notices that changing one number in a URL shows you someone else's invoice, that your password reset email can be replayed, or that a low-privilege account can quietly reach an admin endpoint. Real breaches are usually a chain of small oversights, and chaining is a human skill.

The main flavours

Black box. Testers get nothing but your public URL, like an outside attacker. Realistic, but they may spend most of the budget on reconnaissance.
Grey box. They get normal user accounts and some documentation. Usually the best value — it mirrors the most common real threat, a logged-in user going where they shouldn't.
White box. Full source code and architecture access. The deepest coverage per pound spent, and the right choice for high-risk systems.

Reading the report

Findings come ranked — typically critical, high, medium, low, informational. Resist the urge to treat the list as a scoreboard. Two questions matter for each item: what could an attacker actually do with this? and how hard is it to exploit? A "medium" that exposes customer records deserves attention before a "high" that requires physical access to your office. Fix criticals immediately, plan the rest, and ask for a retest of the serious items once you've shipped fixes — a good firm includes one.

The point of a pen test isn't the report. It's the fixes you ship because of it.

Before you book one

A pen test finds the problems your own discipline missed — it isn't a substitute for having discipline. Get the basics in place first: dependencies patched, secrets out of the codebase, HTTPS everywhere, sensible authentication, permissions checked on the server rather than hidden in the interface. Otherwise you'll pay specialist rates for a report that tells you what a free checklist would have. Then test annually, and after any significant change to authentication, payments or data handling.

Key takeaways

A pen test is an authorised simulated attack, scoped and agreed in writing.
Human testers chain small weaknesses; automated scanners can't.
Grey-box testing usually gives the best value for a product with user accounts.
Prioritise findings by real-world impact, not just the severity label.
Fix the fundamentals first, then test — annually and after major changes.

Frequently asked questions

What is penetration testing?

A penetration test is an authorised, simulated attack on your application or infrastructure carried out by security specialists. They use the same techniques a real attacker would, then report exactly what they found and how to fix it — before someone with bad intentions finds it first.

How is a pen test different from a vulnerability scan?

A scan is automated: it checks your software against a list of known issues and produces a list. A pen test is human: a specialist chains small weaknesses together, tries your business logic and thinks creatively. Scans are cheap and frequent; pen tests are deeper and periodic. You want both.

When should we get our first pen test?

Before you handle real customer data at any meaningful scale, before a major launch, or whenever a customer or certification asks for one. Testing an unfinished product wastes money — but so does launching a product that has never been tested.

ZIVARA builds security into products from the first commit, and helps clients prepare for and act on pen tests. Let's talk. Related: common web vulnerabilities and application security basics.