Glossary

What is a penetration test?

A penetration test, or pen test, is an authorised, simulated attack on a system by security specialists, to find the weaknesses a real attacker could use, so they can be fixed first.

In plain English.

Testers are given permission, an agreed scope and rules, then try to break in the way an attacker would: probing sign-in, access controls, inputs, configuration and the connections between systems. They report what they found, how serious each finding is and how to fix it. The fixes are made, then tested again.

What gets tested

  • Web applications and portals: storefronts, trade portals and customer accounts, usually against the OWASP Top 10.
  • APIs and integrations: the connections to your ERP, CRM, payment and delivery systems.
  • Infrastructure: servers, networks and cloud set-up.
  • Mobile apps.
  • AI: assistants and agents, including attempts at prompt injection.

Pen tests and vulnerability scans

A vulnerability scan is automated and quick, and checks for known problems. Run it often. A penetration test is led by people, goes deeper, and finds the problems a scanner can't, such as one customer being able to see another's orders. Many businesses test at least once a year and after significant changes, and some customers and standards require it.

How we do it

We arrange independent penetration testing, so the people testing your systems aren't the people who built them. Then we fix what it finds and test again. Our own testing is checked as part of our ISO 27001 audits.

Related

Related terms and services.

  • OWASP

    The open guidance most web and AI tests are measured against.

  • Prompt injection

    The attack AI tests look for first.

  • Cybersecurity

    Security reviews, testing and monitoring for your systems and AI.

  • ISO certification and policies

    Our ISO 27001 and ISO 9001 certificates, and the policies behind them.