Glossary
Pentest
A security test in which a team actively attempts to exploit a system, within an agreed scope and window, to demonstrate real impact.
- Penetration test
What separates a pentest from a vulnerability scan is not the tooling, it is the exploitation. The scanner says “this service looks vulnerable”; the pentest demonstrates what the attacker gains by using it, and how far they can go by chaining several minor findings together.
Three elements define the quality of the exercise and are rarely all present: negative scope — what was left out and why; test conditions — the window with dates and times, source IPs, accounts and roles used, whether the WAF was in blocking mode; and the reproducibility of each finding by someone who was not involved.
A pentest without those three is still useful to the technical team, but it will not serve as evidence for an auditor or a buyer, because it does not let anyone bound what was checked and what was not.