Penetration Test

@fkclai

Penetration test (PenTest) is an authorized simulated cyber attack on a computer system, it is not to be confused with vulnerability scanning. The PenTest is performed manually and supported with automated tools to identify weaknesses in the system.

What is the Difference Between Vulnerability Scans and PenTest?

Vulnerability scanners are automated tools to examine the environment to identify known weaknesses in an unpatched environment. Upon completion of scanning, usually, the tool will create a report of the vulnerabilities uncovered. The scanner can uncover thousands of vulnerabilities as of the scanning limitation, prioritization is needed. Additionally, those reported scores do not truly reflect the circumstances of each individual environment. Furthermore, the scanner can only identify the known vulnerability, it cannot find the logical errors, business-related and zero-day vulnerabilities.

Vulnerability scans provide a valuable picture of the potential security weaknesses, while PenTst can add context by seeing if the vulnerabilities could be leveraged to gain access.