What is penetration testing: a guide for UK decision-makers – Computer Forensics Lab | Digital Forensics Services

What is penetration testing: a guide for UK decision-makers

computer forensic services

What is penetration testing: a guide for UK decision-makers

Seo Admin
04/08/2026
What is penetration testing: a guide for UK decision-makers

TL;DR:

  • Penetration testing is an authorized, simulated attack that identifies exploitable weaknesses before real adversaries do. It confirms vulnerability exploitability, reduces false positives, and supports compliance and risk management efforts.

Penetration testing, commonly called a pen test, is an authorised, simulated attack on an IT system, network, or application, conducted by skilled security professionals to identify and demonstrate exploitable weaknesses before a genuine adversary does. The NCSC defines it as a method for gaining assurance in the security of an IT system by attempting to breach some or all of that system’s security using the tools and techniques an adversary might use. Critically, the exercise is authorised, scoped, and governed by documented Rules of Engagement (ROE) agreed in writing before any testing begins.

Commission a penetration test when:

  • Your organisation is launching a new web application, API, or significant infrastructure change
  • A regulatory framework (such as PCI DSS, ISO 27001, or Cyber Essentials Plus) requires independent assurance
  • You have experienced a security incident or data breach and need to understand residual exposure
  • You are approaching a major contract or tender that demands evidence of security assurance
  • You have not tested your environment within the past twelve months and your risk profile has changed

Expect these deliverables from a professional engagement:

  • An executive summary written for non-technical stakeholders, with clear risk ratings
  • A technical appendix containing proof-of-concept (PoC) evidence and step-by-step reproduction steps
  • A prioritised remediation plan with recommended mitigations
  • An option for a retest once critical findings have been addressed

Table of Contents

Why does penetration testing matter beyond vulnerability scanning?

Penetration testing confirms that a vulnerability is genuinely exploitable and quantifies the real-world impact, which is precisely what vulnerability scanning alone cannot do. Where a scanner produces an inventory of potential weaknesses, a skilled tester chains those weaknesses together, escalates privileges, and demonstrates the actual path an attacker would follow to reach sensitive data. That distinction drives better remediation decisions.

Manual, live testing reduces false positives because testers attempt to exploit vulnerabilities and confirm real-world impact. Security teams can then focus remediation effort on genuine risks rather than investigating tool-generated noise. An organisation that receives a scanner report listing 200 medium-severity findings often cannot prioritise effectively; a pen test that demonstrates three of those findings chain together to achieve domain administrator access makes the priority self-evident.

The business case extends beyond technical clarity:

  • Compliance evidence: Pen tests provide documented, independent assurance that supports audits, regulatory submissions, and contractual obligations.
  • Stakeholder confidence: A professionally produced report with clear risk ratings gives boards and clients tangible evidence of security investment.
  • Validated controls: Testing confirms that security controls such as firewalls, WAFs, and access policies function as intended under realistic attack conditions.
  • Incident preparedness: The exercise reveals detection and response gaps, not just technical vulnerabilities.

The NCSC describes pen testing as a powerful but expensive assurance tool, and that framing is deliberate. Pen testing is an assurance activity, not a substitute for continuous vulnerability management, patch cycles, and security hygiene. Organisations that treat a single annual test as their entire security programme misunderstand its purpose.

Pro Tip: Before commissioning a test, prepare an internal vulnerability inventory. The NCSC advises that a pen test should validate your existing vulnerability management processes rather than serve as the primary discovery mechanism. Testers who arrive at a well-prepared environment produce sharper, more actionable findings.

How does penetration testing differ from a vulnerability assessment?

The core distinction is depth and intent: a vulnerability assessment discovers and inventories weaknesses; a penetration test attempts to exploit them and demonstrates real-world impact.

Dimension Vulnerability assessment Penetration test
Purpose Discover and catalogue weaknesses Exploit weaknesses and demonstrate impact
Depth Broad, automated, surface-level Targeted, often manual, deep
False positives High — tools flag potential issues Low — testers confirm exploitability
Cost Lower Higher
Frequency Continuous or frequent Periodic or event-driven
Primary output Prioritised list of vulnerabilities Exploit chains, PoC evidence, risk-rated report

Many organisations use both methods together: vulnerability assessments provide breadth and ongoing coverage, while pen tests confirm exploitability and validate that remediation has been effective.

When to use each:

  • Web application launch: Run a vulnerability assessment during development, then a targeted web application pen test before go-live.
  • Regulatory requirement (e.g. PCI DSS): Both are typically required; the pen test provides the independent assurance the standard demands.
  • Continuous security programme: Automated vulnerability scanning runs continuously; pen tests are scheduled quarterly, annually, or after significant changes.

What types of penetration tests are there?

Methodology: how much does the tester know?

Three knowledge-level approaches define the starting conditions of any engagement.

Black box testing gives the tester no prior knowledge of the target environment. This most closely replicates an external attacker with no insider information, but it is the least efficient use of testing time because reconnaissance consumes a significant portion of the engagement.

Grey box testing provides partial information, typically user-level credentials or network diagrams. This balances realism with efficiency and is the most common approach for web application and internal network tests.

White box testing gives the tester full access to architecture documentation, source code, and credentials. It is the most thorough approach and is well-suited to secure code review, pre-launch assurance, and compliance-driven assessments where exhaustive coverage is required.

Target types and their primary risks

  • External network: Public-facing infrastructure, firewalls, and perimeter devices. Risk: unauthorised access to internal systems via internet-exposed services.
  • Internal network: Systems accessible from within the corporate network. Risk: lateral movement and privilege escalation following an initial compromise.
  • Web application: APIs, web portals, and customer-facing applications. Risk: injection attacks, authentication bypass, and data exfiltration via application logic flaws.
  • Mobile application: iOS and Android apps and their backend APIs. Risk: insecure data storage, weak authentication, and API exposure.
  • Wireless: Wi-Fi infrastructure and guest networks. Risk: unauthorised network access via weak encryption or rogue access points.
  • Social engineering: Phishing, vishing, and pretexting campaigns targeting staff. Risk: credential theft and malware delivery through human error.
  • Physical: Access controls, server rooms, and reception security. Risk: physical device compromise or data theft through tailgating and lock bypass.
  • Operational technology (OT) and industrial control systems: SCADA, PLCs, and building management systems. Risk: operational disruption or safety incidents.

Testing OT, medical devices, or critical national infrastructure requires specialist safety controls, additional legal precautions, and testers with specific domain expertise. Standard IT pen-testing methodologies are not directly transferable to these environments.

How does a penetration test actually work?

A professional penetration test follows a structured lifecycle: scoping and legal agreement, reconnaissance, exploitation, evidence collection, reporting, and remediation verification. Each phase has defined objectives and outputs.

  1. Scoping: Define the target systems, IP ranges, applications, and test types. Agree on objectives, success criteria, and any systems explicitly excluded from testing.
  2. Rules of Engagement (ROE): Produce a signed legal document specifying authorised targets, permitted techniques, testing windows, escalation contacts, and liability arrangements. No testing begins without this.
  3. Reconnaissance: Gather information about the target using open-source intelligence (OSINT), DNS enumeration, port scanning with tools such as Nmap, and service fingerprinting. This phase maps the attack surface.
  4. Exploitation: Attempt to exploit identified weaknesses using tools such as Metasploit for network exploitation and Burp Suite for web application testing. Testers chain vulnerabilities to demonstrate realistic attack paths, replicating attacker tactics, techniques, and procedures.
  5. Evidence collection: Capture screenshots, logs, and PoC artefacts that demonstrate successful exploitation without causing unnecessary harm to live systems or data.
  6. Reporting: Produce a structured report containing an executive summary, risk-rated findings, PoC evidence, and step-by-step reproduction instructions. Professional reports separate management-level findings from technical appendices so both boards and engineers can act on them.
  7. Remediation and retest: The client addresses findings; the tester verifies that critical and high-severity vulnerabilities have been resolved in a follow-up retest.

Pro Tip: Define clear success criteria before testing begins, not after. Specify what “critical” means for your organisation (for example, access to production databases or domain administrator privileges) and agree on outage-risk thresholds. This prevents scope disputes and ensures the report maps directly to your risk register.

Who should carry out your penetration test?

Penetration tests are conducted either by in-house red teams or by specialist third-party providers. For most UK organisations, a qualified external provider offers independence, specialist depth, and the objectivity that internal teams cannot credibly provide for their own systems.

UK assurances and accreditations to require:

  • CREST accreditation: The Council of Registered Ethical Security Testers accredits organisations and certifies individual testers. CREST membership is widely recognised by UK regulators and procurement frameworks.
  • CHECK scheme: The NCSC’s CHECK scheme approves suppliers to conduct penetration tests on HMG and critical national infrastructure systems. CHECK status signals a high level of vetting and technical competence.
  • ISO 27001 certification: Indicates that the provider’s own information security management system meets an internationally recognised standard.
  • Relevant professional certifications: Look for testers holding CREST CRT, OSCP (Offensive Security Certified Professional), or equivalent qualifications that demonstrate hands-on technical competence.

Questions to ask prospective testers before commissioning:

  • What is your scoping process, and how do you handle systems that are out of scope but adjacent to targets?
  • How do you handle PoC evidence, and what is your data retention and destruction policy after the engagement?
  • What professional indemnity and cyber liability insurance do you carry?
  • What is your retest policy, and is it included in the quoted fee or charged separately?
  • How do you manage escalation if you discover a critical vulnerability mid-test that poses an immediate risk?

Require a non-disclosure agreement (NDA) before sharing any system documentation or architecture diagrams. Confirm that the provider’s professional indemnity insurance covers the value of systems under test, and clarify liability caps in the contract before signing.

Written authorisation is non-negotiable. Testing systems without explicit, documented permission constitutes an offence under the Computer Misuse Act 1990, regardless of intent. The Rules of Engagement document is the legal instrument that makes testing lawful, and it must be signed by an authorised representative of every organisation whose systems will be tested, including third-party cloud providers and managed service providers where relevant.

Pen tests provide documented evidence supporting standards and audits, and UK organisations frequently use them to demonstrate compliance with GDPR data security obligations, PCI DSS requirements, and sector-specific frameworks such as those from the Financial Conduct Authority (FCA) or the Medicines and Healthcare products Regulatory Agency (MHRA). The ICO expects organisations to take appropriate technical measures to protect personal data; a professionally conducted pen test and its remediation record constitute tangible evidence of that effort.

Pre-test compliance checklist:

  • Obtain written authorisation from all system owners, including third-party providers
  • Notify your internet service provider if testing will generate significant traffic volumes
  • Define blackout windows to avoid testing during critical business periods or maintenance windows
  • Confirm that your cyber liability insurance policy covers authorised penetration testing activities
  • Identify escalation contacts for both the testing team and your internal incident response function
  • Agree data processing terms if the tester will handle or view personal data during the engagement

Pro Tip: If your organisation processes personal data on behalf of clients, check whether your data processing agreements require you to notify clients before conducting security testing. Some contracts treat pen testing as a change that triggers notification obligations.

How long does a pen test take, and what does it cost?

Cost and timeline are driven primarily by scope, complexity, the number of distinct targets, and whether specialist skills such as OT testing or social engineering are required. Retest scope and the depth of PoC evidence expected also affect the final fee.

Primary cost drivers:

  • Number and complexity of in-scope targets (IP ranges, applications, user roles)
  • Testing methodology (black box engagements require more reconnaissance time)
  • Specialist skills required (OT, mobile, social engineering, physical)
  • Regulatory depth of reporting required
  • Whether a retest is included or quoted separately
  • Procurement lead time for CREST or CHECK-accredited providers
Engagement type Typical duration Indicative timeline to commission
External web application (single app) 3–5 days 2–4 weeks lead time
External network perimeter 3–5 days 2–4 weeks lead time
Internal network (mid-size organisation) 5 days 4–6 weeks lead time
Enterprise programme (multiple targets) 3–6 weeks 6 weeks lead time

Budget for remediation and retest as part of the programme cost, not as an afterthought. Organisations that allocate budget only for the initial test often find that critical findings cannot be addressed promptly because development or infrastructure resource has not been reserved. A retest that confirms critical vulnerabilities have been resolved is the evidence that closes the compliance loop.

What should you do after a penetration test?

The test report is the start of a remediation cycle, not the conclusion of a security exercise. Findings that are not acted upon leave the organisation in a worse position than before testing, because the existence of a report documenting exploitable weaknesses creates a discoverable record.

Post-test action checklist:

  • Triage all findings by severity within 48 hours of receiving the report
  • Assign ownership for each finding to a named individual or team
  • Fix critical and high-severity vulnerabilities before addressing medium and low findings
  • Verify fixes through internal testing before requesting a formal retest
  • Update your risk register and vulnerability management records to reflect remediated findings
  • Brief relevant staff on any findings related to human factors, such as phishing susceptibility or weak password practices
  • Integrate findings into your secure development lifecycle to prevent recurrence

Metrics to track over time:

  • Mean time to remediate critical findings
  • Number of open critical and high findings at any point in time
  • Reduction in exploitable vulnerabilities across successive test cycles
  • Percentage of findings from the previous test that recur in the current test

Organisations that run penetration tests on a regular cycle and track these metrics build a defensible, evidence-based security posture. Recurrence of the same finding class across two consecutive tests is a reliable signal that a process or training gap, rather than a one-off technical error, is the root cause.

How does Computerforensicslab deliver penetration testing in the UK?

Computerforensicslab provides penetration testing services from its London base, serving legal teams, corporate clients, law enforcement, and private organisations that require technically rigorous, legally aware security assurance. The service is designed to integrate with the lab’s broader digital forensics and incident response capabilities, so findings from a pen test can be directly connected to forensic investigation, evidence handling, and expert witness reporting where litigation or regulatory action follows.

Typical deliverables from a Computerforensicslab engagement:

  • Scoping document and signed Rules of Engagement before testing begins
  • Executive summary report suitable for board-level review
  • Technical appendix with risk-rated findings, PoC artefacts, and reproduction steps
  • Prioritised remediation plan with recommended mitigations
  • Retest report confirming resolution of critical and high-severity findings

Assurance points:

  • Chain of custody maintained for all evidence and PoC artefacts throughout the engagement
  • Legal-aware reporting structured to support regulatory submissions, contractual obligations, and, where required, court proceedings
  • Integration with digital forensics services for organisations that need combined security testing and incident investigation
  • Bespoke scoping to match the organisation’s risk profile, regulatory requirements, and operational constraints

For legal professionals, the lab’s penetration testing guidance for UK legal teams sets out how testing fits within litigation and compliance contexts. Organisations seeking to understand how penetration testing fits into a wider cybersecurity programme will find further detail on the lab’s approach to integrated security assurance.

Pro Tip: Ask your provider to map each finding in the report to your specific regulatory framework, whether that is GDPR, PCI DSS, or a sector-specific standard. A report that speaks the language of your auditor is significantly more useful than a generic technical document.

Key takeaways

Penetration testing is a legally authorised, expert-led simulation of real attacks that confirms exploitability, supports compliance, and gives organisations the evidence they need to prioritise and justify remediation investment.

Point Details
Authorisation is mandatory Written Rules of Engagement, signed before testing, make the exercise lawful under UK law.
Pen tests confirm exploitability Unlike vulnerability scans, pen tests chain weaknesses together and demonstrate real-world impact, reducing false positives.
Accreditation matters Require CREST or CHECK accreditation and verify professional indemnity insurance before commissioning.
Budget for remediation Reserve resource for fixing and retesting findings; the report alone does not improve security.
Computerforensicslab delivers UK-focused testing The lab provides legally aware, forensically sound penetration testing integrated with digital forensics and incident response services.

Why exploitability matters more than vulnerability counts

The most common mistake organisations make when approaching penetration testing is treating the number of findings as the primary measure of value. A test that returns 150 low-severity findings and misses a single exploitable chain leading to domain administrator access has failed its purpose. The measure of a good pen test is not volume; it is the quality of the exploitation evidence and the clarity of the remediation path.

There is also a persistent misconception that a penetration test is a one-time certification event. A test validates the state of a system on the day of testing. Environments change, new vulnerabilities are disclosed, and configurations drift. Organisations that treat a single test as permanent assurance are, in effect, relying on a snapshot of a moving target. The NCSC’s framing of pen testing as an external audit that validates internal processes is the right mental model: the test is most valuable when it challenges and confirms an active, continuous vulnerability management programme, not when it substitutes for one.

For decision-makers, the practical implication is straightforward. Commission a test with clear objectives, require PoC evidence for every critical finding, and allocate remediation resource before the report arrives. The organisations that extract the most value from penetration testing are those that treat it as one component of a mature security programme, not as the programme itself.

Commission a UK-based penetration test with Computerforensicslab

Computerforensicslab offers organisations a direct route to legally aware, forensically sound penetration testing, without the delays and generic scoping that characterise larger, less specialised providers. Every engagement begins with a bespoke scoping conversation, produces a report structured for both technical and executive audiences, and maintains full chain of custody for all evidence and PoC artefacts. For organisations where findings may feed into regulatory submissions or legal proceedings, that forensic rigour is not optional.

To discuss scope, timelines, and deliverables, contact the lab through its digital forensics services page or request a scoping call directly.

Useful sources and further reading

  • NCSC Penetration Testing Guidance — The primary UK authority on commissioning pen tests. Covers scope, methodology, and what to expect from a professional engagement. Essential reading before approaching any supplier.
  • SANS Institute Penetration Testing Resources — Practitioner-level definitions and methodology references from one of the most respected security training organisations globally.
  • FIRST CVSS — The Common Vulnerability Scoring System, the standard framework for rating vulnerability severity used in professional pen-test reports across the UK and internationally.
Exit mobile version