Penetration test
A penetration test is a commissioned, controlled attack on a website, software or IT infrastructure in which experts deliberately look for security gaps before real attackers find them.
Unlike automated scans, penetration testers proceed like attackers: they combine vulnerabilities, test authentication, permissions and interfaces, and document how far they get.
The result is a report with the vulnerabilities found, their severity and concrete recommendations. The real benefit only arises once these gaps are closed and re-tested.
Penetration tests make sense before launching new software with sensitive data, after major changes and at regular intervals for business-critical systems.
What to look out for
- Define the scope clearly: which systems, which access, which time frame?
- Commission the test in writing and name contacts for emergencies.
- Use a test environment or an agreed time window.
- Fix vulnerabilities prioritised by severity.
- Run a re-test after fixing.
Common mistakes
- The report is filed away, the vulnerabilities remain open.
- An automated scan is sold as a penetration test.
- Testing happens once — never again, although the software changes constantly.
Frequently asked questions
A scan automatically looks for known vulnerabilities. A penetration test proceeds manually and deliberately, combines vulnerabilities and shows what an attacker could actually achieve.
For business-critical systems regularly and additionally after major changes. The right frequency depends on risk, data and rate of change.
More in our article: Website security: the basics every business needs