Security fundamentals

Penetration Testing Explained: Phases, Scope, Reports

Penetration testing (pen testing) is security testing in which assessors mimic real-world attacks to find ways around an application's, system's or network's security features (NIST SP 800-115). Unlike a vulnerability scan, which only checks whether a weakness might exist, a pen test tries to exploit it to confirm that it does.

This is a defensive, buyer-side guide: how tests are structured, how to scope and commission one, and what to expect back. It contains no attack instructions. Test only systems you own or are authorised in writing to test. Planning a test? Use the penetration test scoping tool.

Updated 3 November 2026

The phases

NIST SP 800-115: four phases

Planning: rules are identified, management approval is finalised and documented, and goals are set. No actual testing happens here.
Discovery: the start of actual testing, followed by vulnerability analysis of what was found.
Attack: verifying potential vulnerabilities by attempting to exploit them. If an attack succeeds, the vulnerability is verified and safeguards are identified. The process can loop back to discovery.
Reporting: runs alongside the others; a final report describes vulnerabilities, a risk rating and mitigation guidance.

PTES: seven sections

Pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post exploitation, and reporting. PTES itself does not provide technical how-to; a separate technical guide accompanies it. Both documents are old, so treat them as a shared vocabulary rather than current tactics.

OWASP WSTG for web applications

The OWASP Web Security Testing Guide is a testing resource for web application developers and security professionals; its current stable release at our access date is v4.2.

Types of test

NIST describes test scenarios by attacker viewpoint: an outsider with little or no knowledge of the target working from public information and assumptions, and an insider view. When both are performed, external testing usually comes first. Scenarios should reproduce the most likely and the most damaging attack patterns, including malicious administrator actions. Targets differ too: web applications (WSTG), networks, and specialised environments such as OT and cloud.

Scoping and rules of engagement

Involve the system's risk owners, technical staff who understand it and a representative of the testing team (NCSC).
Write down the technical boundaries, test types, timeframe and effort, and compliance and reporting needs (NCSC).
Agree the rules of engagement before testing: detailed guidelines and constraints that give the team authority to conduct defined activities without further permission (NIST glossary).
PTES pre-engagement covers questions such as why the test is happening, when active testing may run and how a compromised system should be handled. (Our suggestion: also agree in advance how urgent findings will be reported.)

The scoping tool walks you through these decisions.

What a good report contains

An executive summary for decision-makers and a technical report for engineers (PTES).
Each identified vulnerability, with a risk rating and mitigation guidance (NIST).
Scope, methods and objectives, so readers can judge what was and was not tested (PTES).

Remember the NCSC's caveat: a pen test validates your defences against known issues on the day of the test; it complements, and does not replace, ongoing vulnerability management.

Last reviewed 3 November 2026. General information; NCSC provider rules are UK-specific.

Frequently asked questions

What is penetration testing?

NIST SP 800-115 defines it as security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system or network. It often involves launching real attacks on real systems and data, and usually looks for combinations of vulnerabilities that together give more access than a single one.

What is the difference between a penetration test and a vulnerability scan?

NIST SP 800-115 says vulnerability scanners check only for the possible existence of a vulnerability, whereas the attack phase of a penetration test exploits the vulnerability to confirm that it exists.

What are the phases of a penetration test?

NIST SP 800-115 describes four: planning, discovery (which includes vulnerability analysis), attack, and reporting, with reporting running alongside the others. PTES (the Penetration Testing Execution Standard) has seven sections: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post exploitation and reporting.

What should be in the scope?

The UK NCSC says scoping should involve risk owners, technical staff who know the target system, and a representative of the testing team, and should produce a document covering the technical boundaries, the types of test, the timeframe and effort, and any compliance and reporting requirements. NIST calls the agreed detailed guidelines and constraints the rules of engagement (ROE), which give the team authority to carry out defined activities without further permission.

What does a pen test report contain?

NIST SP 800-115 says a report is generally developed to describe identified vulnerabilities, present a risk rating, and give guidance on how to mitigate them. PTES splits reporting into an executive summary and a technical report so that objectives, methods and results reach different audiences.

Is a pen test the main way to find vulnerabilities?

The NCSC says no: it treats penetration testing as a way to check your vulnerability management processes, not the main way to find vulnerabilities, and notes a test can only validate that your systems are not vulnerable to known issues on the day of the test.

Do I need a certified or assured provider?

In the UK, the NCSC recommends that central government (HMG) organisations use testers from CHECK scheme companies; it says CHECK was developed for central government, public sector bodies and critical national infrastructure, and points other organisations to its guidance on commissioning a test. US rules depend on your industry or contract; check your requirements.

Is it legal to test any system?

No. Only test systems you own or have explicit written authorisation to test. Written rules of engagement exist for exactly this reason.