Penetration test
An authorized, time-boxed attempt to find and exploit vulnerabilities in a defined scope, to show what an attacker could achieve. Its value depends on the scope, the testers’ skill and whether the findings are fixed and retested (NIST SP 800-115).
- Also called
- penetration testing · pentest · pen test
Covered in
Guide
Start with a VDP, then add bug bounties and penetration tests
Publish a vulnerability disclosure policy and security.txt first, add a bug bounty only when you can triage and fix at the pace rewards bring, and buy penetration tests with a written scope, rules of engagement and a retest.
Case study
Case study: First American's EaglePro document exposure (2019)
How sequential IDs in unauthenticated links exposed First American's title documents in 2019, after its own penetration test found the flaw and a clerical error let it go unfixed.