Testing methods
Penetration Testing
Also: Pentest · Ethical hacking
Penetration testing is an authorized, simulated attack on an application, network, or system, performed to discover vulnerabilities and demonstrate their real-world impact. Unlike automated scanning, a pentest investigates, chains weaknesses, and proves exploitability - but traditional manual pentests are point-in-time and cannot keep pace with continuous deployment.
Key points
- Authorized, goal-driven simulation of a real attacker.
- Proves impact by chaining and exploiting, not just flagging.
- Manual pentests are periodic; continuous and autonomous testing closes the gap.
FAQ
How often should you run a penetration test?
Compliance often requires at least annual and post-significant-change testing, but applications ship far more frequently than that. Continuous or autonomous penetration testing covers the gap between scheduled engagements, testing new code as it deploys.
Related
Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.