What is penetration testing in simple terms?

Hiring someone to try to break into your own system, with written permission, so you find the weaknesses before an attacker does. The result is a report ranking what they found by severity with the steps to fix each one.

Is penetration testing legal?

It is legal when the owner of the system has authorized it in writing. Testing without that authorization is an offence. This is why every legitimate engagement starts with a signed agreement and written rules of engagement.

How long does a penetration test take?

It depends entirely on scope: the number of systems, the number of user roles, and whether testing is black box or credentialed. The duration is agreed during scoping and written into the rules of engagement before work begins.

Answer

What is penetration testing?

A penetration test is an authorized attempt to break into a system, carried out with the owner's written permission, so that the owner learns what an attacker could reach before an attacker tries.

The word authorized is the whole thing. The same activity without permission is a crime. With a signed agreement and written rules of engagement, it is one of the few ways to find out whether your defences work.

How a penetration test actually runs

The engagement is five steps, and the first two happen before anyone touches a system.

Scoping: agree what will be tested and what will not
Signed agreement and written rules of engagement: targets, window, permitted techniques, contacts
Testing: inside the written scope, stopping at proof of impact
Report: every finding ranked by severity, with remediation steps
Retest: once fixes are in, confirm they hold

What a tester is looking for

Not a list of known bugs; that is a scanner's job. A tester is looking for the path. Individually minor findings that combine into something serious are the characteristic output of a real test.

A verbose error page discloses a username format. A password policy allows a weak password. A management interface is reachable from a subnet it should not be. None of those is critical alone. Together they are an account, and the report says so.

Why exploitation stops at proof of impact

Once a tester has demonstrated they can reach something, continuing adds risk to you and no information to the report. The point is established.

So a tester who gains database access documents the access and stops. They do not exfiltrate the table. The report proves the exposure without creating the incident it was hired to prevent.

What you should expect to receive

A written report, not a tool export. Every finding ranked by severity, remediation steps for each one, and one retest once your fixes are deployed.

If a vendor's deliverable is a scanner PDF with their logo on it, you bought a scan. The judgment applied to the output is the thing you are paying for.

Questions

What is penetration testing in simple terms?: Hiring someone to try to break into your own system, with written permission, so you find the weaknesses before an attacker does. The result is a report ranking what they found by severity with the steps to fix each one.
Is penetration testing legal?: It is legal when the owner of the system has authorized it in writing. Testing without that authorization is an offence. This is why every legitimate engagement starts with a signed agreement and written rules of engagement.
How long does a penetration test take?: It depends entirely on scope: the number of systems, the number of user roles, and whether testing is black box or credentialed. The duration is agreed during scoping and written into the rules of engagement before work begins.

Sources

OWASP Top 10:2025

Standards and legislation are quoted from the sources above and change over time. Read the primary source before relying on it. Nothing on this page is legal advice.

Next step

Start with a scoping call.

Tell us what you need tested. Before any testing begins, the scope is written down and the agreement and rules of engagement are signed.

Book a scoping call