Building software securely takes more than following coding standards and running automated scans. Applications can still contain vulnerabilities that are difficult to detect without testing how they behave under attack.
Penetration testing helps businesses identify these weaknesses before they are exploited. Security specialists simulate authorised attacks against applications, networks, or other systems to assess what an attacker could access and what the findings mean for the business.
This guide explains how penetration testing works, how it differs from vulnerability scanning, the main types of testing, and when businesses should arrange a test. It also covers compliance, costs, and what to look for when choosing a penetration testing partner.
What is Penetration Testing?
Penetration testing, also called pen testing or a pen test, is an authorised security assessment in which specialists attempt to exploit weaknesses in a system under agreed conditions.
Unlike automated tools that identify potential vulnerabilities, penetration testers use technical knowledge and manual investigation to determine whether those weaknesses can be exploited and what impact they could have.
Penetration testing can cover several areas of a business’s technology environment:
- Web applications: Websites, customer portals, and SaaS platforms that process user information or business transactions.
- Networks and infrastructure: Servers, network devices, firewalls, and internal systems.
- Mobile applications and APIs: Mobile apps and the interfaces connecting applications to backend services.
- Cloud environments: Cloud services, access permissions, storage, and configuration settings.
- People and processes: Social engineering assessments that evaluate how employees respond to simulated attacks, where included in the agreed scope.
- The right scope depends on the systems a business operates, the information it handles, and the threats it needs to assess.
Why Penetration Testing Matters
A security weakness can affect more than technology. Depending on the system and the data involved, an exploited vulnerability may lead to unauthorised access, service disruption, data exposure, financial losses, or damage to customer trust.
Penetration testing helps businesses understand these risks in practical terms. Instead of relying solely on a list of potential vulnerabilities, they can see which weaknesses are exploitable, how far an attacker might get, and which issues should be addressed first.
It can also help development teams improve their security practices. Findings from a test may reveal problems with authentication, access controls, application architecture, or development processes that need attention beyond a single fix.
Penetration testing does not eliminate every security risk. It provides an assessment of the tested systems at a particular point in time, helping businesses make better-informed decisions about security improvements.
Penetration Testing vs. Vulnerability Scanning
Penetration testing and vulnerability scanning serve different purposes. Both are useful parts of a security programme, but one does not replace the other.
| Vulnerability Scanning | Penetration Testing | |
| Method | Automated tools scan for known issues | Skilled testers use tools and manual expertise |
| Depth | Finds and lists potential weaknesses | Proves what can actually be exploited |
| Human judgment | Minimal | Central to the work |
| Frequency | Continuous or monthly | Periodic, and after major changes |
| Output | A list of possible vulnerabilities | A prioritised report with proof and fixes |
A vulnerability assessment helps teams monitor known issues and maintain an overview of their security posture. Penetration testing investigates selected systems more deeply to assess realistic attack paths and the potential consequences of exploitation.
A practical approach combines regular vulnerability scanning with penetration testing at appropriate intervals. Both also complement functional software testing, which checks whether an application behaves as expected.
Types of Penetration Testing
The types of penetration testing can be grouped by the systems being assessed and the amount of information available to the tester.
Types by Target
| Type | What It Tests |
| Web application penetration testing | Application logic, authentication, access controls, and vulnerabilities in websites or web-based platforms |
| Network penetration testing | Network services, exposed ports, infrastructure, and opportunities for unauthorised access |
| Mobile application testing | Mobile app security, local data storage, authentication, and communication with backend services |
| API penetration testing | API authentication, authorisation, input handling, and access to data or functions |
| Cloud penetration testing | Relevant cloud configurations, permissions, workloads, and exposed services, within the provider’s testing rules |
| Social engineering testing | Employee responses to simulated phishing or other agreed scenarios |
For many businesses, web application penetration testing is a useful starting point when their websites or software platforms handle customer data, payments, or sensitive business information.
The scope should reflect the actual environment. For example, testing a web application does not automatically cover its underlying network, mobile applications, or cloud infrastructure.
By Approach: Black, Grey, and White Box
These approaches describe how much information the tester receives before testing begins.
| Approach | What the Tester Knows | Best For |
| Black box | Nothing, like a real outside attacker | Simulating a genuine external attack |
| Grey box | Some access, such as a user login | Testing what an insider or logged-in user could do |
| White box | Full access to code and architecture | Deep, thorough review of a critical system |
Black-box testing provides an external perspective, while white-box testing allows testers to investigate areas that may be difficult to identify from the outside. Grey-box testing can be useful for applications where authenticated users have access to sensitive functions or information.
No single approach is best for every situation. The choice depends on the assessment objectives, available information, time, and required depth of testing.
The Penetration Testing Process
A penetration testing engagement should follow an agreed methodology with clear boundaries, documented findings, and a process for addressing identified weaknesses.
| Stage | What Happens | Expected Outcome |
| 1. Scoping and planning | Define the systems, objectives, testing window, permissions, and rules of engagement | An agreed scope and testing plan |
| 2. Reconnaissance | Gather information about the target and identify its attack surface | An understanding of the systems and potential entry points |
| 3. Vulnerability identification | Use appropriate tools and manual investigation to identify weaknesses | A list of issues for further assessment |
| 4. Exploitation | Safely attempt to validate whether identified weaknesses can be exploited | Evidence of exploitable vulnerabilities and their potential impact |
| 5. Impact assessment | Assess relevant access, permissions, and possible attack paths within the agreed scope | A clearer understanding of the risks |
| 6. Reporting and remediation | Document findings, prioritise risks, and recommend corrective actions | A report that technical teams can use to address issues |
| 7. Retesting | Reassess agreed findings after fixes have been implemented | Confirmation of whether the tested issues have been resolved |
The exact process varies depending on the target and methodology. Testing should remain within the authorised scope, with appropriate safeguards to minimise disruption to production systems and business operations.
Recognised resources such as the OWASP Top 10 and NIST’s Technical Guide to Information Security Testing and Assessment can help inform the testing approach.
What Does Penetration Testing Commonly Find?
Penetration testing can uncover several categories of security weaknesses, depending on the system and its configuration.
Common findings include:
- Broken access control: Users can access information or perform actions beyond their intended permissions.
- Injection vulnerabilities: Improper input handling allows malicious input to affect database queries or other system operations.
- Security misconfiguration: Unnecessary exposed services, insecure settings, or excessive permissions create avoidable risks.
- Vulnerable components: Outdated libraries or software contain known security weaknesses.
- Authentication and session weaknesses: Flaws in login mechanisms or session management may allow unauthorised access.
- Sensitive data exposure: Confidential information is not adequately protected during storage, transmission, or access.
- Business logic flaws: Application workflows can be manipulated to bypass intended rules or perform unauthorised transactions.
The importance of a finding depends on the context. A vulnerability’s severity, exploitability, affected assets, and potential business impact should all inform remediation priorities.
When and How Often Should You Pen Test?
Penetration testing should be repeated as systems and risks change. A test reflects the environment assessed at that time, so its findings may no longer represent the current situation after significant changes or the discovery of new vulnerabilities.
Businesses should consider penetration testing:
- Before launching a new application or a significant new feature.
- After major changes to application architecture, authentication, infrastructure, or access controls.
- At regular intervals, often annually for important systems, depending on risk and applicable requirements.
- After significant security incidents, where testing can help assess relevant weaknesses.
- When required by a contractual obligation, customer requirement, or applicable security standard.
Systems with sensitive data, frequent releases, or higher exposure may need more frequent testing. Regular vulnerability scanning and secure development practices should continue between penetration tests.
The appropriate schedule should be based on risk, system changes, business requirements, and the results of previous assessments rather than a fixed interval alone.
Penetration Testing and Compliance
Penetration testing can support compliance with security standards and regulatory requirements, but conducting a test does not automatically make an organisation compliant.
The relevant requirements depend on the standard, the organisation’s role, and the systems or data involved.
| Standard or Regulation | How Penetration Testing Can Help |
| PCI DSS | Supports the assessment of systems within the payment card data environment. PCI DSS includes specific penetration testing requirements for applicable environments. |
| ISO 27001 | Can provide evidence supporting security risk assessment and the evaluation of technical controls within an information security management system. |
| SOC 2 | Can support the evaluation of security controls and provide evidence relevant to an audit, depending on the organisation’s scope and control requirements. |
| GDPR | Can help organisations evaluate technical security measures relevant to protecting personal data, depending on the risks and circumstances. |
Each framework has its own requirements. ISO 27001 certification, a SOC 2 examination, or GDPR compliance involves more than penetration testing alone.
Businesses should identify the specific requirements applicable to their environment and confirm the expected testing scope, frequency, documentation, and reporting with the relevant compliance or audit specialists.
How to Choose a Penetration Testing Partner
Choosing a penetration testing company involves more than comparing prices. The provider should understand the systems being tested, explain its methodology, and deliver findings that your team can act on.
1. Confirm the Testing Scope and Methodology
Ask which systems and components are included, what testing methods will be used, and which areas are excluded. The provider should explain how it combines automated tools with manual investigation and how the assessment aligns with your objectives.
2. Evaluate Technical Experience
Look for experience relevant to your technology stack and environment, whether that involves web applications, APIs, mobile apps, networks, or cloud infrastructure.
Ask about the team’s qualifications, relevant project experience, and the testing methodologies it follows. Security testing requires practical technical expertise as well as familiarity with recognised standards.
3. Review the Reporting Process
A useful penetration testing report should explain:
- What was tested and which limitations applied.
- What vulnerabilities were identified and how they were validated.
- The potential impact and severity of each finding.
- Recommended remediation steps.
- Any relevant evidence to help developers reproduce and understand the issues.
The report should be understandable to both technical teams and decision-makers.
4. Ask About Remediation and Retesting
Confirm whether the provider offers remediation guidance and retesting after fixes are implemented. Agreeing on how findings will be reviewed and closed helps ensure the assessment leads to practical improvements.
5. Understand the Commercial Terms
Clarify the price, timeline, deliverables, testing conditions, and any additional fees for retesting or expanded scope. A clear agreement helps avoid misunderstandings during the engagement.
For broader guidance on evaluating development partners, see Choosing the Right Software Partner in Thailand and How to Build a Project Communication Plan. These links should point to the relevant existing articles before publication.
What Does Penetration Testing Cost?
Penetration testing cost depends on the scope and complexity of the engagement. There is no single price that applies to every application or business.
The main factors affecting the cost include:
- Application size and complexity: A large application with multiple user roles and complex workflows generally requires more testing time.
- Number of targets: Testing several applications, APIs, networks, or cloud environments increases the scope.
- Testing approach: White-box assessments and deeper manual investigations may require additional preparation and effort.
- Technical environment: Complex integrations, authentication mechanisms, and infrastructure can increase the work involved.
- Reporting and retesting: Detailed reporting, remediation support, and follow-up testing may affect the overall price.
A focused web application penetration test may be a practical starting point for a business with a clearly defined target. Larger environments can be assessed in phases, prioritising the systems with the greatest exposure or business importance.
When comparing proposals, review the actual testing activities and deliverables rather than the quoted price alone. A useful comparison should make clear what is included, what is excluded, how findings will be reported, and whether retesting is covered.
The goal is to select an assessment that provides appropriate coverage for the risks involved and gives the business a clear basis for improving security.
Penetration Testing in Thailand: What Manao Software Delivers
Manao Software provides web application penetration testing for businesses that want to understand the security weaknesses in their software and determine how to address them.
Our approach focuses on defined testing scope, recognised methodologies, technical investigation, and clear reporting. The objective is to help businesses understand relevant vulnerabilities and give development teams practical guidance for remediation.
An engagement can include:
- Scoped security assessments: Define the application and testing objectives based on the business’s needs.
- Methodology-driven testing: Use relevant security testing practices and resources, including OWASP guidance, to inform the assessment.
- Technical validation: Investigate identified weaknesses to assess their exploitability and potential impact.
- Prioritised reporting: Document findings with severity, supporting evidence, and recommended corrective actions.
- Remediation guidance and retesting: Help teams understand findings and verify whether agreed fixes have resolved the identified issues.
Manao’s software development and QA experience also helps connect security findings with the practical work required to improve an application. Manao is an ISTQB Gold Partner, a recognition related to software testing and quality assurance rather than a cybersecurity certification.
For businesses looking for a dedicated assessment, our web application penetration testing services provide a starting point for discussing the appropriate scope and objectives.
Not sure where to start? Talk to our team about your application, security concerns, and testing requirements.
