Originally published: August 22, 2023. Last updated: Oct 09, 2026.
A penetration test is an authorized simulated cyberattack against an organization’s own systems. Ethical hackers imitate the behavior of real attackers to find security weaknesses before criminals do, then report exactly how each weakness could be exploited and how to fix it. For businesses deciding where to start, the first step is understanding that penetration testing comes in several distinct types, and choosing the wrong one wastes both time and budget.
This guide covers the six main types of penetration testing, the three standard approaches testers use, how a typical test runs, and how to choose the right combination for your business.
Two Ways to Classify Penetration Tests
Before the six types, it helps to know that the industry classifies tests along two dimensions. The first is what is being tested (the target: networks, web applications, people, and so on). The second is how much the tester knows in advance, which determines how realistic the simulation is:
- Black-box testing: the tester starts with no inside knowledge, just like an external attacker would. This best simulates a real-world attack but can miss deep logic flaws that are only visible from the inside.
- White-box testing: the tester gets full access, including source code, architecture diagrams, and credentials. This finds the most vulnerabilities, including subtle logic errors, but is less like a real external attack.
- Grey-box testing: the tester gets partial knowledge, such as a standard user account. This simulates an insider threat or an attacker who has already gained a foothold, and it balances realism with depth.
Any of the six test types below can be run as black-box, white-box, or grey-box. When scoping a test with a provider, this is one of the first decisions to make.
1. Network Penetration Testing
Network penetration testing targets the infrastructure that carries business data: servers, switches, routers, and firewalls. Testers look for misconfigurations, unpatched services, weak credentials, and unnecessary open ports that could let an attacker in or allow lateral movement once inside.
Typical techniques include firewall rule review, network sniffing to see what traffic is exposed, and attempts to bypass network segmentation between sensitive zones (for example, between the corporate network and the payment environment). This is usually the first type of testing a business commissions, because the network is the foundation everything else runs on. It pairs naturally with broader security solutions such as vulnerability scanning, though scanning only lists potential issues while penetration testing proves which ones are actually exploitable.
Choose it when: you have never tested before, you have recently changed network architecture, or you need to validate firewall and segmentation controls.
2. Web Application Penetration Testing
Web applications are among the most attacked assets a business owns, because they are exposed to the internet by design. Web application testing focuses on the application layer: the source code, business logic, authentication flows, databases behind the app, and APIs it exposes.
Testers probe for the classic web vulnerabilities documented in the OWASP Web Security Testing Guide, the industry’s standard reference for this work: SQL injection, cross-site scripting (XSS), broken authentication, insecure direct object references, and flaws in how the application handles user sessions. Just as important are business-logic flaws, such as a checkout flow that can be manipulated to change prices, which automated scanners routinely miss.
Choose it when: you run customer-facing web apps, portals, or APIs, especially after major releases or before handling sensitive data such as payments or personal records.
3. Social Engineering Penetration Testing
People are consistently the weakest link in security, and attackers know it. Social engineering testing targets the human layer: phishing emails, pretexting phone calls, baiting with infected USB drives left in parking lots, and physical impersonation at reception desks.
The goal is not to embarrass employees but to measure how the organization actually responds. A good test tracks who clicked, who reported the phish, and how quickly the security team reacted, then uses those results to design targeted security awareness training. Because this type involves deceiving your own staff, it requires careful scoping and explicit management authorization. Between tests, CISA’s guidance on avoiding social engineering and phishing attacks is a practical starting point for staff education.
Choose it when: you want to test your security culture, you have had phishing incidents, or compliance requires proof of awareness training effectiveness.
4. Physical Penetration Testing
Physical testing assesses the controls that protect buildings and hardware: locks, badge readers, CCTV, alarm systems, and server room access. Testers attempt techniques such as tailgating (following an employee through a secured door), badge cloning, and gaining after-hours access to restricted areas.
A single physical breach can bypass every digital control at once. An attacker with hands on a server or an unattended workstation does not need to hack the firewall. Physical testing is especially relevant for businesses with on-premises infrastructure, sensitive paper records, or regulated data.
Choose it when: you operate offices, data centers, or facilities with restricted areas, or you need to validate physical controls for compliance.
5. Wireless Penetration Testing
Wireless networks broadcast beyond your walls by nature, which makes them a natural target. Wireless testing examines Wi-Fi configuration, encryption standards, guest network isolation, and the presence of rogue access points that employees may have plugged in without approval.
Testers attempt attacks such as de-authentication (forcibly disconnecting clients to capture reconnection handshakes), cracking weak pre-shared keys, and setting up evil-twin access points that mimic the corporate network to intercept credentials. With hybrid work and office IoT devices multiplying the number of wireless endpoints, this surface keeps growing.
Choose it when: you run corporate Wi-Fi across offices, retail, or warehouses, or you suspect unauthorized wireless devices on the network.
6. IoT Penetration Testing
Connected devices, from smart cameras and sensors to industrial controllers, ship with notoriously weak security: default credentials, unencrypted communication, and firmware that is never updated. IoT testing examines the full device ecosystem: the hardware itself, embedded software and firmware, communication protocols, and the web and mobile applications used to manage the devices.
Testers extract and analyze firmware, intercept device traffic, and probe management interfaces for vulnerabilities. These are exactly the weaknesses catalogued in the OWASP Internet of Things project, whose IoT Top 10 lists weak default credentials, insecure network services, and missing secure update mechanisms among the most common device flaws. Because a compromised IoT device can become a foothold into the corporate network, this testing matters far beyond the devices themselves.
Choose it when: you deploy connected devices at any scale, in offices, manufacturing, logistics, or smart buildings.
How a Penetration Test Typically Runs
Regardless of type, professional tests follow a standard methodology. NIST Special Publication 800-115, the U.S. federal guide to security testing, organizes the work into three phases: planning, execution, and post-execution. Another widely used reference is the community-maintained Penetration Testing Execution Standard (PTES), which breaks an engagement into seven phases from pre-engagement interactions through reporting. When evaluating providers, asking which methodology they follow is a quick quality check: a serious firm can name theirs.
- Scoping and planning: the tester and the business agree in writing on targets, timing, the black/white/grey-box approach, and rules of engagement (what is off-limits, who to contact if something breaks).
- Reconnaissance: gathering information about the target, from network mapping to open-source intelligence.
- Vulnerability analysis and exploitation: identifying weaknesses and carefully attempting to exploit them to prove real-world impact, without causing damage.
- Reporting: a detailed report ranking each finding by severity, with evidence and concrete remediation steps. This report, not the hacking itself, is the actual product you are paying for.
- Remediation and retesting: the business fixes the issues, and the tester verifies the fixes hold.
How to Choose and How Often to Test
Start with your biggest exposure. Most businesses begin with network and web application testing, then add social engineering once the technical basics are covered. Regulated industries often have mandated scope and frequency, so check your compliance obligations first.
As a rule of thumb, test at least annually, and additionally after any significant change: a major application release, a network redesign, a cloud migration, or a merger. If you only remember one principle, make it this: penetration testing is a recurring practice, not a one-time certificate. Attackers do not test you once a year.
Penetration Testing vs. Red Teaming
These terms are often confused, and providers sometimes blur them. A penetration test has a defined scope and a cooperative client: the goal is to find as many vulnerabilities as possible within the agreed targets. A red team exercise is broader and adversarial: a team simulates a specific real-world threat actor against the whole organization, including its people and processes, often without the defenders knowing the exercise is happening. In short, penetration testing tests your systems; red teaming tests your detection and response. Most businesses start with penetration testing and graduate to red teaming once the basics are solid.
FAQ
What is the difference between penetration testing and vulnerability scanning?
Vulnerability scanning uses automated tools to list known weaknesses. Penetration testing goes further: a human tester attempts to actually exploit the weaknesses to show what an attacker could really achieve. Scanning is broad and shallow; pen testing is targeted and deep. Most mature security programs use both.
How long does a penetration test take?
A focused test of a single web application typically takes one to three weeks. A broad engagement covering networks, applications, and social engineering can run four to eight weeks or more, depending on scope.
Is penetration testing legal?
Yes, when it is authorized. Every legitimate test starts with a written agreement defining exactly what may be tested. Testing systems without permission is illegal in most jurisdictions, which is why the scoping phase exists.
What should a penetration test report include?
At minimum: an executive summary for management, findings ranked by severity with technical evidence, clear remediation steps for each issue, and a retest to confirm fixes. If a provider will not commit to this in writing, find another provider.
