{"id":3815,"date":"2026-11-01T15:24:18","date_gmt":"2026-11-01T23:24:18","guid":{"rendered":"https:\/\/cyber.mag212.com\/learn\/pentest-what-to-expect\/"},"modified":"2026-11-01T15:25:58","modified_gmt":"2026-11-01T23:25:58","slug":"pentest-what-to-expect","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/learn\/pentest-what-to-expect\/","title":{"rendered":"Penetration Testing: What to Expect"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-pentest\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style>\n<section class=\"hero\"><div class=\"kick\">MAG212 CYBER \u00b7 Learn \u00b7 Security<\/div>\n<h2>Penetration testing: <span>what to expect.<\/span><\/h2>\n<p>A penetration test (pentest) is an authorised, simulated attack carried out by skilled people to find the weaknesses a real attacker would use, and to prove what they could reach. This guide explains the types of test, how an engagement runs, how to prepare, and what you should get at the end.<\/p>\n<div class=\"toc\"><a href=\"#what\">What it is (and isn&#8217;t)<\/a><a href=\"#types\">Types of test<\/a><a href=\"#when\">When you need one<\/a><a href=\"#steps\">How it runs<\/a><a href=\"#prepare\">How to prepare<\/a><a href=\"#report\">The report<\/a><a href=\"#after\">After the test<\/a><\/div><\/section>\n\n<section class=\"sec\" id=\"what\"><h3>What a pentest is, and isn&#8217;t<\/h3>\n<div class=\"tscroll\" style=\"overflow-x:auto;-webkit-overflow-scrolling:touch\"><table style=\"min-width:560px\"><tbody><tr><th><\/th><th>Vulnerability scan<\/th><th>Penetration test<\/th><th>Red team<\/th><\/tr>\n<tr><td><b>Done by<\/b><\/td><td>Mostly automated tools<\/td><td>Skilled testers, with tools<\/td><td>A small expert team<\/td><\/tr>\n<tr><td><b>Goal<\/b><\/td><td>List known weaknesses<\/td><td>Find and prove exploitable weaknesses, and how they chain together<\/td><td>Reach a business objective without being detected<\/td><\/tr>\n<tr><td><b>Coverage<\/b><\/td><td>Broad, shallow<\/td><td>Deep, within an agreed scope<\/td><td>Narrow, realistic attack path<\/td><\/tr>\n<tr><td><b>Tests your detection?<\/b><\/td><td>No<\/td><td>Sometimes<\/td><td>Yes, that is the point<\/td><\/tr>\n<tr><td><b>Typical frequency<\/b><\/td><td>Monthly or quarterly<\/td><td>Yearly and after major change<\/td><td>When defences are mature<\/td><\/tr>\n<\/tbody><\/table><\/div>\n<p>Scanning tells you a door might be unlocked. A pentest walks through it, shows what is on the other side, and tells you which locks to fix first.<\/p><\/section>\n\n<section class=\"sec\" id=\"types\"><h3>Types of test<\/h3>\n<ul class=\"l\">\n<li><b>External network:<\/b> what anyone on the internet can reach: firewalls, VPNs, mail, remote access and exposed services.<\/li>\n<li><b>Internal network:<\/b> what an attacker can do once inside, for example from an infected laptop: Active Directory, file shares, legacy protocols, segmentation.<\/li>\n<li><b>Web application and API:<\/b> login, access control, injection and business-logic flaws, usually following the OWASP Web Security Testing Guide.<\/li>\n<li><b>Wireless:<\/b> Wi-Fi encryption, guest isolation and rogue access points.<\/li>\n<li><b>Cloud configuration:<\/b> identities, storage permissions and exposed management interfaces.<\/li>\n<li><b>Social engineering:<\/b> phishing simulations, phone pretexting and, by agreement, physical access.<\/li>\n<\/ul>\n<p>Tests can also be <b>black box<\/b> (testers start with no information), <b>grey box<\/b> (a normal user account and basic network details) or <b>white box<\/b> (full documentation and access). Grey box usually gives the best value for the time spent.<\/p><\/section>\n\n<section class=\"sec\" id=\"when\"><h3>When you need one<\/h3>\n<ul class=\"l\">\n<li><b>At least yearly and after significant changes<\/b>, such as a new network design, a major application release, a merger or a cloud migration.<\/li>\n<li><b>For PCI DSS:<\/b> v4.0 Requirement 11.4 requires internal and external penetration testing at least every 12 months and after significant change, plus testing of any segmentation used to reduce scope at least every 12 months (every six months for service providers).<\/li>\n<li><b>Before a launch,<\/b> after a security incident, or when customers, insurers or auditors ask for evidence.<\/li>\n<\/ul><\/section>\n\n<section class=\"sec\" id=\"steps\"><h3>How an engagement runs<\/h3>\n<ol class=\"l\">\n<li><b>Scoping call:<\/b> goals, systems, test type and any compliance needs.<\/li>\n<li><b>Rules of engagement and written authorisation:<\/b> exact targets (IP ranges, URLs), dates and test windows, what is out of bounds, emergency contacts and how sensitive data will be handled. Never allow testing without this signed.<\/li>\n<li><b>Reconnaissance and discovery:<\/b> mapping hosts, services, users and technologies.<\/li>\n<li><b>Vulnerability analysis:<\/b> combining tools with manual checks to find likely weaknesses.<\/li>\n<li><b>Exploitation:<\/b> safely proving which weaknesses are real and how far they lead, staying within the agreed rules.<\/li>\n<li><b>Reporting and debrief:<\/b> a written report and a walkthrough with your team.<\/li>\n<li><b>Retest:<\/b> confirming that fixes actually work.<\/li>\n<\/ol>\n<p>Good testers follow a recognised methodology such as PTES, NIST SP 800-115 or the OWASP testing guides, and keep a log of every action so anything unexpected can be traced.<\/p><\/section>\n\n<section class=\"sec\" id=\"prepare\"><h3>How to prepare<\/h3>\n<ul class=\"l\">\n<li><b>Know what you own.<\/b> An accurate list of sites, devices, IP ranges and applications makes scoping faster and stops forgotten systems being missed. This is exactly what <a href=\"\/services\/#m212-atlas\">MAG212 Atlas<\/a> maps for us before and during a test.<\/li>\n<li><b>Name one contact<\/b> on your side who can make decisions during the test.<\/li>\n<li><b>Check backups<\/b> and confirm critical systems can be restored, just in case.<\/li>\n<li><b>Prepare test accounts<\/b> for grey-box testing, with the same rights as normal staff.<\/li>\n<li><b>Decide who knows.<\/b> Tell your IT provider or SOC, or keep it quiet to test detection, but agree this up front.<\/li>\n<li><b>Get third-party permission<\/b> where needed: hosting, cloud and SaaS providers have their own testing policies.<\/li>\n<li><b>Avoid big changes<\/b> during the test window so results stay meaningful.<\/li>\n<\/ul><\/section>\n\n<section class=\"sec\" id=\"report\"><h3>What a good report contains<\/h3>\n<ul class=\"l\">\n<li><b>Executive summary<\/b> in plain language: overall risk, the most serious findings and what to do first.<\/li>\n<li><b>Scope and method:<\/b> what was tested, when and how, including anything not tested.<\/li>\n<li><b>Findings<\/b> rated by severity, usually with CVSS (<span class=\"pill p-c\">Critical<\/span> <span class=\"pill p-h\">High<\/span> <span class=\"pill p-m\">Medium<\/span> <span class=\"pill p-l\">Low<\/span>), each with evidence, business impact, steps to reproduce and clear remediation advice. See <a href=\"\/learn\/cve-cvss\/\">CVE &amp; CVSS explained<\/a>.<\/li>\n<li><b>Attack paths<\/b> showing how smaller issues chained into a serious compromise.<\/li>\n<li><b>What worked well,<\/b> so you keep the controls that stopped the testers.<\/li>\n<\/ul><\/section>\n\n<section class=\"sec\" id=\"after\"><h3>After the test<\/h3>\n<ol class=\"l\">\n<li>Fix critical and high findings first, especially anything that leads to domain admin or customer data.<\/li>\n<li>Assign each finding an owner and a date, and track it to completion.<\/li>\n<li>Ask for a retest to confirm the fixes, then fold lessons into your hardening baseline.<\/li>\n<\/ol>\n<div class=\"callout\"><b>Choosing a provider?<\/b> Ask for a sample report, the testers&#8217; qualifications and experience, how they protect your data, whether a retest is included, and proof of professional insurance.<\/div>\n<p class=\"small\">Sources: PCI Security Standards Council, PCI DSS v4.0.1 Requirement 11.4; NIST SP 800-115, Technical Guide to Information Security Testing and Assessment; Penetration Testing Execution Standard (PTES); OWASP Web Security Testing Guide. Reviewed November 2026.<\/p><\/section>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, penetration testing with MAG212 Atlas, and security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<\/div>\n<style>.m212toc,.m212more{font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:#e6edf3;box-sizing:border-box}.m212toc{background:#0f1720;border:1px solid #1f2d3a;border-radius:12px;padding:14px 18px;margin:0 0 22px}.m212toc summary{cursor:pointer;font-weight:800;font-size:15px;list-style:none;display:flex;justify-content:space-between;align-items:center;gap:10px}.m212toc summary::-webkit-details-marker{display:none}.m212toc summary span{font-size:12px;font-weight:700;color:#9fb0c0}.m212toc summary::after{content:\"\u25be\";color:#3cc8f0;margin-left:auto}.m212toc details:not([open]) summary::after{content:\"\u25b8\"}.m212toc ol{margin:12px 0 0;padding:0 0 0 20px;columns:2 260px;column-gap:28px}.m212toc li{margin:0 0 6px;break-inside:avoid;font-size:14px;color:#9fb0c0}.m212toc a{color:#3cc8f0;text-decoration:none}.m212toc a:hover{text-decoration:underline}h2[id^=\"m212s-\"]{scroll-margin-top:110px}.m212more{display:flex;flex-wrap:wrap;gap:10px;margin:28px 0 8px;padding:16px;background:#0f1720;border:1px solid #1f2d3a;border-radius:12px}.m212more a{flex:1 1 200px;display:block;text-decoration:none;color:#e6edf3;background:#121c27;border:1px solid #2a3b4b;border-radius:10px;padding:10px 14px;font-size:14px;font-weight:700}.m212more a small{display:block;font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#3ee6a0;margin-bottom:2px}.m212more a:hover{border-color:#3cc8f0}<\/style><nav class=\"m212more\" aria-label=\"Keep learning\"><a href=\"\/learn\/\"><small>Back to<\/small>All learning guides<\/a><a href=\"\/learn\/windows-hardening\/\"><small>\u2190 Previous<\/small>Windows hardening checklist<\/a><a href=\"\/services\/#m212-atlas\"><small>Related<\/small>MAG212 Atlas pentest platform<\/a><\/nav>\n","protected":false},"excerpt":{"rendered":"<p>MAG212 CYBER \u00b7 Learn \u00b7 Security Penetration testing: what to expect. A penetration test (pentest) is an authorised, simulated attack carried out by skilled people to find the weaknesses a real attacker would use, and to prove what they could reach. This guide explains the types of test, how an engagement runs, how to prepare, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3385,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3815","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3815","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3815"}],"version-history":[{"count":2,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3815\/revisions"}],"predecessor-version":[{"id":3823,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3815\/revisions\/3823"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3385"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3815"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}