What Is a Penetration Test?
Selva Ops S.R.L.
A penetration test (pentest) is an authorized, time-bounded engagement in which testers attempt to compromise systems or applications the way a real attacker would — under agreed rules, with documented evidence, and with the goal of improving security rather than causing harm.
It is not a product certificate. It is not an automated vulnerability scan with a new cover page. It is primarily human testing (assisted by tools) aimed at demonstrating impact: what can be broken, how far access can go, and what should be fixed first.
Pentest versus vulnerability scan
| Vulnerability scan | Penetration test | |
|---|---|---|
| Method | Automated signatures and heuristics | Manual + tooling; hypothesis and exploitation |
| Auth | Often shallow or absent | Real roles and sessions |
| Business logic | Rarely covered | Core of the work |
| False positives | Common | Verified before reporting |
| Question answered | “Are known weaknesses present?” | “What can an attacker achieve here?” |
Both belong in a mature program. Do not buy one labeled as the other.
Useful primary methodology references:
Common types
- Black / grey / white box — by how much information the testers receive (grey box is the usual default for web apps and APIs).
- By surface — web, API, mobile, network, social engineering (only with explicit authorization), LLM/AI systems.
What a solid deliverable includes
Scope statement, dates, methodology, findings with reproduction steps and evidence, remediation guidance, an executive summary, and a retest path.
Scoping and provider selection
Map scope to the systems that matter for your threat model and any compliance evidence you need (for example SOC 2). Prefer authenticated, role-based testing of your web application over scan-only packages.
The Spanish cornerstone for this topic is published as Qué es una prueba de penetración.