What Is Penetration Testing? Types, Process and Pricing Factors

Penetration testing is an authorized security specialist attacking an organization’s systems with the methods a real attacker would use, within limits agreed in writing beforehand. Also called a pentest, its purpose is not just to list weaknesses but to show whether they can actually be exploited and how far an attacker could get inside the network.

This guide covers the types of penetration test, the stages a test goes through, what a good report should contain and the scope factors that drive pricing. For IT managers and security leads, the aim is to define scope correctly before asking for quotes.

What is penetration testing and why is it done?

A penetration test measures how well an organization withstands attack through a controlled attack. A weakness flagged by an automated tool may look high-risk on paper but be unexploitable in your environment; conversely, a few low-severity issues chained together can lead all the way to domain administrator rights. The value of the test is showing that chain with evidence.

The main reasons organizations commission a pentest are:

• Seeing real risk: Proving which weakness could lead to a data breach or system takeover.
• Validation after change: Checking security after a new application, an infrastructure migration or a major upgrade.
• Compliance and audit: Producing evidence for customer contracts, sector regulations or information security audits.
• Prioritization: Making sure a limited security budget is spent on the most critical gaps.

The US National Institute of Standards and Technology’s security testing guide likewise describes penetration testing as a validation technique for understanding how attackers could circumvent security controls (NIST SP 800-115).

Penetration testing vs vulnerability scanning

Vulnerability scanning lists known weaknesses with automated tools; a pentest has a specialist verify whether those weaknesses can be exploited. One does not replace the other; they complement each other.

For continuous visibility, vulnerability scanning and a pentest for in-depth validation are planned together. Where scanning runs regularly, the pentest can skip known issues and focus on more complex attack paths.

Types of penetration test

Tests are grouped by where the attacker starts and which asset is targeted. Scope is set by choosing one or more of these types.

• External network test: Internet-facing IP addresses, firewalls, VPN and mail servers tested from outside.
• Internal network test: How far an attacker on the network, or a compromised employee laptop, could get.
• Web application test: Authentication, authorization, session management and input validation flaws.
• Active Directory test: Domain configuration, password policies and privilege escalation paths.
• API security test: Authorization and data access controls in the back-end services behind web and mobile apps.
• Wireless network test: Encryption and segmentation settings of corporate wireless networks.

Tests also differ by how much information is shared. In a black-box test the specialist only gets target addresses; in a grey-box test a limited user account is provided; in a white-box test architecture and source code are shared. Grey-box testing is common in corporate projects because it yields the most findings in limited time. A comprehensive checklist for web applications is published in the OWASP Web Security Testing Guide.

How does penetration testing work? The 7-stage process

A pentest starts with a written scope and ends with a report. The widely used Penetration Testing Execution Standard (PTES) defines the process in seven sections (PTES):

1. Pre-engagement and scope: Targets, test window, permitted techniques, contacts and emergency stop conditions written down.
2. Intelligence gathering: Target systems, exposed services and public information collected.
3. Threat modeling: The organization’s most valuable assets and likely attacker profiles identified.
4. Vulnerability analysis: Weaknesses found by tools and by hand verified.
5. Exploitation: Verified weaknesses used in a controlled way to gain access.
6. Post-exploitation: Measuring how far that access reaches and which data it exposes.
7. Reporting: Findings, evidence, risk levels and remediation advice documented.

To avoid affecting production, techniques that could cause an outage are agreed in advance. On critical systems, such attempts run in a maintenance window or in a test environment.

What should a penetration test report contain?

The report is the real output of the test and must serve two readers: a short risk summary for management and reproducible finding detail for the technical team. A report made only of tool output does not tell you what to fix first.

• Executive summary: Overall risk level and the three to five most critical findings, with business impact.
• Finding detail: Affected system, description, exploitation steps and evidence such as screenshots.
• Risk rating: A consistent scale such as critical, high, medium and low.
• Remediation advice: An actionable fix for every finding.
• Scope and method: What was tested, what was out of scope and the methodology used.

Planning a retest after fixes, to confirm critical findings are closed, shows whether the report actually produced results.

What determines penetration test pricing?

Penetration test pricing is driven by scope and the number of specialist days required. That is why a written quote after scope is clear works better than a fixed price list. The main factors are:

• Number of targets: External IP addresses, servers, web applications and APIs.
• Application complexity: Number of roles, workflows and high-risk features such as payments or file upload.
• Test types: External network only, or internal network, Active Directory and wireless as well?
• Information level: Black-, grey- or white-box approach.
• Time constraints: Out-of-hours testing, maintenance windows or a short deadline.
• Retest: Whether verification of fixes is included in the quote.

When comparing quotes, look beyond the total. For the same scope, compare specialist days, the share of manual testing, report content and whether a retest is included. A very low quote often covers automated scanning only.

Common practice and the right approach

In many organizations, a pentest happens once a year on the audit calendar and the report is filed away. When findings are not tracked, the same issues reappear in next year’s report.

Common penetration testing mistakes and how to avoid them

Most mistakes happen in preparation. A test with unclear scope either leaves critical systems out or causes unexpected outages in production.

• Starting without written authorization: Systems, date range and techniques should be signed off by authorized people.
• Not informing the cloud or hosting provider: Check the provider’s testing policy and notify them in advance if required.
• No point of contact: Define who to reach during a critical finding or an outage before the test starts.
• Not prioritizing findings: Assign an owner and a target date to critical and high findings.

To keep watching for exploitation of the weaknesses a test uncovers, a SOC service and central log management can be planned as a complementary layer.

Penetration testing in Türkiye, KVKK and confidentiality

During a test, specialists may access personal data, so the contract should state confidentiality, that data is not retained and that access is removed afterwards. The technical measures expected of data controllers under Türkiye’s personal data protection law (KVKK) include security and penetration testing; organizations should review their own obligations with legal counsel. This is general information and not legal advice.

For a first assessment of technical measures, the KVKK technical measures checklist can be used. The MAV Cloud team treats test scope, access credentials and finding reports as confidential data.

MAV Cloud penetration testing: scope, methodology and standards

The MAV Cloud penetration testing service covers external network, internal network, web application, Active Directory, API and wireless network testing. Tests follow OWASP, MITRE ATT&CK, PTES and NIST methodologies, and the output is a technical report with findings classified by risk level and remediation advice for each.

• Information security: ISO/IEC 27001 certified information security management system.
• Privacy: ISO/IEC 27701 certified privacy information management system.
• Attacker behavior model: Findings can be mapped to MITRE ATT&CK techniques.

Service scope and the quote process are detailed on our penetration testing page.

Frequently Asked Questions

What is penetration testing?

Penetration testing is an authorized security specialist attacking an organization’s systems with real attacker methods, within limits agreed in writing. The goal is to show whether weaknesses can actually be exploited and how far an attacker could get.

Is a pentest the same as a penetration test?

Yes. Pentest is the short form of penetration test; it is also called pen testing.

What determines penetration test pricing?

Pricing depends on the number of targets, application complexity, the test types chosen, black- or grey-box approach, time constraints and whether a retest is included. That is why a written quote after scope is defined is recommended.

How long does a penetration test take?

It depends on scope. A single web application can take a few days, while a project combining external, internal and Active Directory tests takes longer; report preparation adds to that time.

How often should penetration testing be done?

The common approach is at least once a year and after major changes. Launching a new application, migrating infrastructure or significant network architecture changes are good times for a new test.

Can a penetration test damage systems?

In a controlled test with written scope, risk is kept to a minimum. Techniques that could cause outages are agreed in advance, critical systems are tested in a maintenance window or test environment and emergency stop conditions are defined.

What is the difference between penetration testing and vulnerability scanning?

Vulnerability scanning regularly lists known weaknesses with automated tools. Penetration testing is a specialist manually verifying whether those weaknesses can be exploited and what their impact is.

What should a penetration test report include?

It should include an executive summary, affected systems, exploitation steps and evidence, a consistent risk rating, remediation advice for every finding, and the test scope and methodology.

Readers new to penetration testing can start with the types and process sections. Teams comparing quotes can use the pricing factors as a scope checklist. Organizations ready to test can share their target list and get a written quote from the MAV Cloud team.