penetration test

in English: penetration testing

advancedwidespread

A pre-arranged, authorized test attack in which specialists attempt to break into an IT system to find weak points before real attackers do.

In plain terms

Imagine hiring a reliable locksmith: ask them to try to get into your house the way a burglar would. They take nothing, but at the end, they tell you they were inside through the basement window in two minutes. Penetration testing is the same, but with computer systems: websites, mobile applications, and corporate networks.

The tester – also known as an ethical hacker – uses the same tools and tricks as criminals. The difference is the written permission, the pre-defined framework, and the fact that they provide improvement suggestions at the end rather than demanding a ransom.

It differs from a simple security check in that it does not just list possible vulnerabilities but also tries to see what can be achieved with them. This reveals whether a seemingly minor flaw actually leads to the entire customer database.

AI has appeared here from two directions. On one hand, AI agents already independently search for and test vulnerabilities; on the other, the AI systems themselves must be tested, for example to see if they can be tricked by clever text instructions into doing something they should not.

How it works

Authorization and boundaries: the client and tester document in writing what may be attacked, when, by what methods, and what is forbidden (for example, shutting down live systems).
Reconnaissance: the tester gathers what is visible from the outside of the system – servers, software versions, public email addresses, and forgotten test pages.
Vulnerability scanning: automated tools and manual inspection map weak points, such as outdated software, weak passwords, or incorrect settings.
Exploitation: the tester tries, in a controlled manner, to actually gain entry, then checks how far they can get from there, for example whether they can reach customer data or administrator privileges.
Report and retest: the client receives a detailed description of errors ranked by severity, with repair suggestions; after repair, the tester rechecks them.

An everyday example

Your bank is releasing a new mobile app, but first an external team spends two weeks trying to break into it: they try to log into someone else's account, alter a transfer, or extract data. All you see is that the app appears a few weeks later, after the flaws that were found have been fixed.

Who is affected

entrepreneur, executiveYou place the order and decide on the repair, and in several sectors, legislation or contracts with major clients also require regular testing.

developerThe report lists errors in your code, and you must fix them; if you think like the testers, there will be fewer of them. → Code

bank customer, investorThe security of your money and data partly depends on whether the bank's systems are regularly tested for breaches by well-intentioned experts. → Money

employeeThe test may include a disguised phishing email or phone call to measure how easily employees can be deceived. → Work & HR

A common misconception

MythIf a system passes a penetration test, it is secure.

In realityA test is a snapshot: it only shows what testers found within a given timeframe and constraints. A new update or a newly discovered bug can open a new vulnerability the next day.

Limits and risks

Only written permission makes it legal: testing another system without permission can be a crime even with good intentions.
Limited in time and scope, it does not prove the absence of errors, only that the ones found exist.
The quality of the result depends heavily on the tester's expertise; a cheap "test" created with a purely automated tool can give a false sense of security.
Testing with AI agents can be faster and cheaper, but an agent can make mistakes, report non-existent errors, exceed its assigned scope, and the same technique is also in the hands of attackers.

Similar, but not the same

vulnerability assessment – Scanning is largely automatic, listing possible vulnerabilities, while penetration testing actually attempts to breach them.
red teaming – Red teaming is a longer, hidden, goal-driven attack simulation that also measures an organization's detection and defense capabilities, not just flaws in a designated system.
bug bounty program – There, independent researchers search for bugs continuously in response to an open call and are paid per finding, while a penetration test is a time-limited, contracted job by a commissioned team.

Related concepts

Broader

cybersecurity, security audit, risk management

Narrower

web application test, social engineering teszt, AI red teaming

On the edge

etikus hekker, vulnerability assessment, red teaming, bug bounty program, prompt injection

A brief history

The issue of 'intrusion' (penetration) into computer systems was first raised more broadly in a professional context at an American computing conference in 1967. Following this, so-called tiger teams, commissioned by the US government, began systematically testing system defenses.

Where things stand

By the end of 2026, penetration testing is an established, mandatory practice in many sectors. In the EU, for example, the DORA regulation, applicable since January 2025 for the financial sector, requires regular security testing, and significant institutions must conduct threat-based penetration tests simulating real attacks at least every three years. The novelty is that an increasing share of the work is performed by AI agents under human supervision, and the AI systems themselves have become test targets.

Status: 2026 November

Also known as

penetration test · penetration test · penetration test · penetration test · pentest · penteszt · penetration test · ethical hacking

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.