Penetration test

A penetration test is an authorised attempt to break into a system, carried out by specialists, in order to find weaknesses before someone hostile does. It goes beyond automated scanning: a tester chains together several small flaws the way a real attacker would.

The value depends entirely on scope and timing. A test against a staging copy with a narrow brief finds narrow problems; a test that includes authentication, access control between accounts and the deployment configuration finds the ones that matter. Commissioning it a week before launch, with no time to fix anything, is a compliance exercise rather than a security one.

Expect the report to contain findings — one that does not is usually evidence of a shallow test. What matters afterwards is triage, fixes for the serious items, and a retest confirming they are closed.