Glossary
Penetration test
Also called: Pen test, ethical hacking
In one sentence
An authorized simulated attack in which security testers try to break into your systems, to show which weaknesses an attacker could really use.
In a penetration test, a qualified tester (or team) is given permission to attack your systems the way a criminal would — trying passwords, exploiting unpatched software, tricking staff, or moving from one compromised computer to others. The result is a report showing what they got into, how, and what to fix first.
A pen test is different from a vulnerability scan. A scan is automated and lists possible weaknesses; a pen test has a human try to chain those weaknesses together to prove real impact. Scans are cheap and should run often; pen tests cost more and are typically done once a year or after major changes.
Do small businesses need one? Not always. Many small practices get more value from fixing the basics first — MFA everywhere, patch management, EDR, protected backups. But pen tests are often requested by larger clients, some insurers and some frameworks, and HHS’s proposed HIPAA Security Rule update (January 2025, not final as of this writing) included periodic penetration testing.
Example: an accounting firm preparing for a large client’s vendor review commissions an external pen test. The tester finds an old remote-access port left open on the firewall; it’s closed before the review, and the report becomes evidence of good practice. Our compliance readiness service helps you scope a test and fix the findings.
Related terms
- Vulnerability scanAn automated check of your computers, network and software for known security weaknesses such as missing updates or risky settings.
- Security risk assessmentA security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.
- SOC 2An independent audit report, based on AICPA criteria, that shows how a service company protects the data it handles for its clients.
- Patch managementPatch management is the ongoing process of installing security updates on operating systems, applications and devices — on a schedule, with tracking, so nothing is left unprotected.
- FirewallA device or piece of software that controls what network traffic is allowed in and out, blocking connections that don’t match its rules.