Penetration testing (pentest)
pentest · pen test · pentesting · ethical hacking · intrusion test · test d’intrusion
A simulated attack, carried out by authorised specialists, to find the weaknesses in a system before a real attacker exploits them.
In practice
The tester follows an attacker’s approach (reconnaissance, vulnerability discovery, controlled exploitation) within a scope and time window agreed in advance, then delivers a report that ranks each flaw by severity, proves its impact and recommends a fix. In France, entering a system without its owner’s consent is a criminal offence (Article 323-1 of the French Criminal Code: up to 3 years in prison and a €100,000 fine), so a pentest always requires written authorisation from the system owner. For sensitive needs, ANSSI, the French national cybersecurity agency, qualifies audit providers (PASSI).
Fictional case: an 80-person SME has its customer extranet tested. Within three days, the auditor finds that a forgotten demo account gives access to every customer’s invoices. The fix takes an hour; a leak would have meant notifying the CNIL, the French data protection authority, and losing customers’ trust.
