A penetration test is an authorised, simulated attack on your systems, carried out by a qualified tester to find the weaknesses a real attacker could use and to prove which ones actually work. The common types are external, internal, web application, wireless and social engineering tests. ERS IT Solutions, based in Blanchardstown, Dublin 15 since 1983, offers penetration testing and scopes each engagement after a short call.
What is penetration testing?
The UK's National Cyber Security Centre describes penetration testing as a way of gaining assurance in a system's security by attempting to breach some or all of it, using the same tools and techniques an adversary might.
A good test does not just list problems. It shows which weaknesses can really be exploited, how far an attacker could get, and what to fix first.
How is penetration testing done?
Most testers follow a recognised method, such as NIST's Technical Guide to Information Security Testing and Assessment (SP 800-115) or, for websites, the OWASP Web Security Testing Guide. The steps for penetration testing are broadly the same for a network or a website:
- Scope and authorisation. Agree what is in and out of scope, the dates and the contacts, and get written permission.
- Reconnaissance. Gather public information: domains, IP ranges, staff email formats, exposed services.
- Scanning and enumeration. Map live systems, open ports and software versions.
- Exploitation. Try to use those weaknesses to gain access, within the agreed rules.
- Post-exploitation. See what an attacker could reach from that foothold: other systems, admin rights, sensitive data.
- Reporting. Write up each finding with its risk and how to fix it.
- Retest. Check that the fixes worked.
Those are also the network penetration testing steps. Only the targets change: firewalls and servers for a network, logins and input handling for a website.
Pen test vs vulnerability scan: what is the difference?
A vulnerability scan is automated. Software checks your systems against a database of known weaknesses and produces a list. A penetration test is led by a person who uses scan results as a starting point, then tries to exploit the weaknesses, chain them together and show the real impact.
| Vulnerability scan | Vulnerability assessment | Penetration test | |
|---|---|---|---|
| Who does it | Software | Analyst reviewing scan results | Qualified tester |
| What you get | List of known weaknesses | Prioritised list with context | Proof of what can actually be exploited |
| False positives | Common | Reduced | Confirmed or ruled out |
| Best for | Regular checks for known issues | Deciding what to fix first | Proving real-world risk |
The NCSC makes the point that a penetration test should be seen as a way to check your own vulnerability management, not as the primary way of finding vulnerabilities. Scanning and patching should run all year, and the test checks they work.
"Security testing" is the umbrella term for all of this. Penetration testing vs security testing is a part versus the whole: scans, code reviews, configuration audits and pen tests are all forms of security testing. Vulnerability testing usually means the scan or assessment without exploitation.
What types of penetration test are there?
- External penetration testing. Tests what the internet can see: your firewall, VPN, email gateway, remote desktop and any public servers.
- Internal penetration testing. Starts inside your network, as if from a staff laptop or a compromised account, to see how far an attacker could move.
- Web application and website testing. Tests your website, portals and customer apps for problems like broken logins, injection flaws and weak session handling.
- API testing. Tests the interfaces your apps use to exchange data. The OWASP API Security Top 10 lists the common faults, led by broken object level authorisation.
- Wireless testing. Checks your Wi-Fi: encryption, guest network separation and rogue access points.
- Social engineering. Tests people rather than systems, through phishing emails, phone pretexting or attempts to get into the building.
Penetration testing: internal vs external
An external test answers "can someone on the internet get in?" An internal test answers "if someone gets in, or a staff account is stolen, how much damage can they do?"
Most SMEs start with an external test, as it covers the most exposed systems. An internal test matters too, because phishing and stolen passwords put attackers inside without touching the firewall. Many engagements combine both.
Rules of engagement and authorisation
Testing without permission is a crime in Ireland. Section 2 of the Criminal Justice (Offences Relating to Information Systems) Act 2017 makes it an offence to intentionally access an information system by infringing a security measure without lawful authority or reasonable excuse. Written authorisation from the system owner is what makes a test lawful.
The rules of engagement are the written requirements for penetration testing, and they double as your penetration testing plan. The NCSC's guidance says the scoping document should state the technical boundaries, the types of test, the timeframe and effort, any compliance requirements and the reporting format. In practice, a good template also covers:
- Signed authorisation from someone who owns the systems.
- Exact IP ranges, URLs and accounts in scope, and what is out of scope.
- Testing windows, and whether production systems can be touched.
- Who to call if something breaks or a live attack is found.
- How evidence and any data seen during testing are stored and deleted.
What does a penetration test report contain?
According to the NCSC, the report should include the security issues found, the tester's assessment of the risk each one poses, a method of resolving each issue, an opinion on the accuracy of your own vulnerability assessment, and advice on improving that process.
A useful report has a plain-language summary for directors and a technical section with evidence, severity ratings and fixes for your IT team.
How often should you have a penetration test?
Once a year is common, and the NCSC notes that a year or more often passes between tests. It also warns that relying on pen tests alone leaves weaknesses unnoticed for long periods. Test again after significant change: a new website or portal, a move to the cloud, a new office network or a merger.
How much does penetration testing cost?
There is no fixed price, and we have not found a reliable independent Irish price guide, so we do not quote a range here. Tests are usually priced on effort, and the NCSC says scoping documents typically state effort in resource days. What drives the number of days:
- Scope. How many IP addresses, sites, applications and user roles are tested.
- Type. An external test of a small office is far quicker than a web application with several logins.
- Depth. Black box (no information given), grey box (some access given) or white box (full details).
- Compliance. Some customers or standards need specific reporting or a retest.
- Timing. Out-of-hours testing to avoid disruption takes longer to plan.
ERS quotes per business after a short call.
What is penetration testing as a service?
Penetration testing as a service (PTaaS) replaces a one-off yearly test with a subscription: testing through the year, findings as they are found and retests on demand. It suits businesses whose systems change often.
Automated penetration testing and online penetration testing tools run attack steps by software. They are useful between tests, but they cannot judge business logic or chain small issues together the way a person can. Treat them as a step above scanning, not a replacement for a human-led test.
DAST vs penetration testing, and threat modelling vs penetration testing
Dynamic application security testing (DAST) is automated scanning of a running web application. It suits developers testing each release. A penetration test adds a person probing logic flaws a scanner cannot recognise.
Threat modelling happens earlier. OWASP describes it as a way to identify, communicate and understand threats and mitigations, ideally started in the planning phase. It shapes the design. A penetration test later checks whether the finished system holds up.
Penetration testing tools
The best tools for penetration testing are well known and widely shared: network scanners such as Nmap, web proxies such as Burp Suite, exploitation frameworks such as Metasploit and packet analysers such as Wireshark. Since anyone can download them, tools do not separate a good test from a poor one. The tester's skill and the report do.
How penetration testing links to NIS2, Cyber Essentials Plus, ISO 27001 and cyber insurance
- NIS2. Article 21(2) of the NIS2 Directive requires "policies and procedures to assess the effectiveness of cybersecurity risk-management measures", plus vulnerability handling. It does not name penetration testing as a requirement, but a test is clear evidence for both. See our NIS2 compliance guide for where Irish law stands.
- Cyber Essentials Plus. The NCSC says Plus independently tests your systems to verify the five controls work. That testing is focused on those five controls, so it is narrower than a full penetration test. Read our Cyber Essentials guide.
- ISO 27001. The standard does not name penetration testing as a requirement. Control 8.29 covers security testing in development and acceptance, and guidance on it lists penetration tests among the expected methods. See our ISO 27001 certification guide.
- Cyber insurance. If a proposal form asks how you test your defences, a recent report with a record of the fixes is direct evidence. Our cyber insurance requirements guide covers what insurers ask for.
How to choose a penetration testing company
Lists of the "top 10 penetration testing companies" are mostly marketing. The best penetration testing company or consultant for you scopes properly, explains findings plainly and retests. Ask:
- Who will do the testing, and what certifications they hold.
- Which method they follow.
- For a sample report, with client details removed.
- Whether a retest is included.
- How they will avoid disrupting your business.
On certifications: CREST accredits testing companies and certifies individual testers, OffSec's OSCP is a widely recognised hands-on certification, and the UK NCSC's CHECK scheme is for UK government and critical infrastructure work. There is no single best penetration testing certification. What matters is practical, hands-on experience in the type of test you need.
Penetration testing services from ERS
ERS offers penetration testing as part of our managed cyber security services. A good engagement covers scoping and written authorisation, the agreed tests, a report your directors and IT team can both use, and a retest once fixes are in. We scope each engagement after a short call, because the right test depends on your systems and why you need it.
Testing works best alongside the day-to-day defences it checks, such as managed detection and response and Microsoft 365 monitoring. Web portals that hold sensitive data, like the JMB vetting portal we built for schools, are the kind of system a web application test is designed for.
Contact us or call 01 885 9500.