Summary

• Penetration testing is an authorised, simulated cyber attack that shows which weaknesses an attacker could actually use, and how far they could get.
• A vulnerability scan lists possible problems, while a penetration test is carried out by people who try to exploit them.
• Most guidance sets a minimum of one test a year, but new weaknesses appear between tests, so a single annual test leaves long gaps.
• The value of a test sits in the report and the fixes that follow, so check a provider’s reporting and retesting before you sign. 

 

Every business with a website or email accounts has weak spots, and penetration testing helps you find them before an attacker does. Security experts try to break in the way a real hacker would, so you can see whether your defences hold up.

The test itself is only the start. How often you test and what happens with what the testers find, decides whether a report makes you any safer. Both are worth knowing before you compare penetration testing services.

 

What Is Penetration Testing?

Penetration testing, also called pen testing, is an authorised, simulated cyber attack on your systems to find security weaknesses before attackers do. The NCSC describes it as “a method for gaining assurance in the security of an IT system by attempting to breach some or all of that system’s security, using the same tools and techniques as an adversary might.” 

Unlike a real attack, a pen test happens with your permission. You and the testers agree beforehand what will be tested and when, so the test is legal and planned around your business.

The people who carry out these tests are often called ethical hackers. They use the same methods as real attackers and report back everything they find to you so it can be fixed. 

 

How Does Penetration Testing Improve Your Company’s Security?

Penetration testing improves your security by showing you which weaknesses an attacker could use and what to fix first. In practice, a test helps your business in four ways:

 

1. It finds weaknesses before attackers do. A test can uncover weak passwords, outdated software, cloud settings left open or gaps in your network, so you can fix them before anyone else finds them.
2. It shows which problems matter most. Most businesses have more security issues than they can fix at once. A test shows which ones an attacker could actually use, so you can deal with the most serious ones first. 
3. It checks that your defences work. Security tools can be set up correctly and still miss a real attack. A test also shows whether your security operations centre or IT provider spots the attack while it is happening. 
4. It gives you evidence for compliance and customers. Standards such as PCI DSS require regular penetration testing, and a test report gives you proof to share when a customer asks how you protect their data.

 

Penetration testing works best as one part of your wider security. The NCSC calls it “not a magic bullet”, because a test can only check for “known issues on the day of the test”.

Testing is most useful when its results feed straight into the rest of your security. Each weakness found gets fixed, your monitoring is set up to watch for the same type of attack, and the next test checks that the fix has been held. That is far easier when the same provider runs your testing, your IT and your security, because there is no handover between companies for a finding to get lost in. 

 

What Are the Main Types of Penetration Testing?

The type of penetration test depends on which part of your business is being tested. The table below shows the main types, and a typical problem each one could uncover in a business. 

Type	What It Tests	Example of a Problem It Could Uncover
Web Application	Websites, customer portals and online forms	A flaw in your customer portal that lets one customer log in and see another customer’s personal details. This is the top risk in the OWASP Top 10, the standard list of web application risks
External Network	Systems anyone on the internet can reach, such as firewalls, remote access and email servers	A remote access system that has missed a security update, letting an attacker in from outside
Internal Network	What an attacker could reach once inside, for example after a phishing email works	One admin password used on every computer, so an attacker who gets into one gets into all of them
Cloud	Settings in services such as Microsoft 365, AWS, Azure and Google Cloud	A folder of customer files shared with “anyone with the link”, so anyone who finds the link can open it
Wireless	Office Wi-Fi networks	A guest Wi-Fi network that lets visitors reach the same systems as staff
Social Engineering	Your staff, through phishing emails, phone calls or attempts to get into the building	A staff member gives their password to a caller pretending to be from IT support

Using the table above, the systems anyone on the internet can reach, such as your website and remote access, are usually a sensible place to start. A red team exercise goes further than a single test, combining several of these methods to check whether your business can detect and respond to a realistic attack. 

In one of ThreatSpike’s red team exercises, a phishing email led staff to a copy of the Microsoft login page, and testers used the details some employees entered to get into their accounts. From there, they found passwords saved in plain text in SharePoint and took control of a laptop within minutes.

Testers can also approach any of these types of tests with different levels of inside knowledge. In a black box test, they start with little more than your company name, as an outside attacker would. In a white box test, they get the full details of your systems, which lets them dig deeper in less time. A grey box test sits between the two, often starting with the access an ordinary employee would have.

 

What Are the 5 Stages of Penetration Testing?

A penetration test follows five stages, from agreeing what to test through to fixing what the testers find. They are based on the four phases in the US government’s NIST technical guide to security testing (planning, discovery, attack and reporting), with the attack phase split into two steps. 

1. Planning and agreeing what to test. You and the testers agree what will be tested, the rules and the timing. The NCSC recommends involving the people responsible for the systems, your technical staff and the test team, and setting out “the technical boundaries of the test”.
2. Discovery: mapping your systems. Testers gather information about your business and use tools to map what is exposed, such as open connections and the software versions you run.
3. Gaining access. Testers try to break in using the weaknesses they found, for example a weak password or a system that has missed an update. 
4. Widening access. Once inside, testers see how far an attacker could get. A single phished user can be enough, as one of our Active Directory tests showed, when the same admin password reused across machines gave the tester full control of the network.
5. Reporting and fixing. The NCSC says the report should include “any security issues uncovered”, an assessment of the risk each one poses and “a method of resolving each issue found”. Once the fixes are in place, a retest confirms that they work. 

 

 

 

Is Vulnerability Scanning the Same as Penetration Testing?

No, a vulnerability scan is an automated check that lists known weaknesses, while a penetration test is carried out by people who try to exploit those weaknesses to see what an attacker could achieve. As NHS England Digital puts it, “The differences are mostly around intent”, with a scan producing a list of things to update or patch, and a penetration test working towards a goal such as getting into an admin account.

The table below shows how the two compare.

	Vulnerability Scan	Penetration Test
How it works	Automated tools check systems against a list of known issues	Skilled testers look for weaknesses and try to exploit them
What you get	A list of missing updates and settings to fix	Proof of what an attacker could reach, with the risk and a fix for each issue
How often	Regularly, often on a schedule	At least once a year, and after major changes

What Can Real Breaches Teach You About Penetration Testing?

Two UK breaches investigated by the Information Commissioner’s Office (ICO) show the kind of weaknesses penetration testing is designed to find, and what happens when they stay open.

The Electoral Commission (2021). Attackers got into a Microsoft Exchange Server through “known software vulnerabilities in the system that had not been secured”, months after the security updates for them were released. Many accounts also still used passwords similar to those first issued by the service desk.

The attackers had access for over a year, and data on approximately 40 million people was compromised. The ICO said that if basic steps such as patching and password management had been taken, “It is highly likely that this data breach would not have happened.” 

Capita (2023). A malicious file on an employee device let an attacker gain administrator permissions and move across the network, and the personal data of 6.6 million people was stolen. The ICO fined Capita £14 million and found that systems holding sensitive records “were not subject to any subsequent penetration test” after they were set up. The weaknesses had also been “flagged as a vulnerability on at least three separate occasions but were not remedied.” 

In both cases, the weaknesses were known long before an attacker used them. A penetration test protects you when it is repeated as your systems change, and when its findings reach the people who can fix them.

 

How Often Should You Run a Penetration Test?

You should run a penetration test at least once a year, and again after any major change to your systems. PCI DSS, the security standard for businesses that take card payments, sets the same minimum. Its penetration testing guidance says testing “must be performed at least annually and after any significant change”.

A major change could be:

• Launching a new website, customer portal or app
• Moving systems or data to the cloud
• Moving office or changing how your network is set up
• Recovering from a security incident 

 

Testing only once a year leaves long gaps when your systems are changing but no one is testing them. The NCSC notes that “it’s not uncommon for a year or more to elapse between penetration tests”, and a new weakness can appear at any point in that time. An annual pen test tells you what your security looked like on one day, and it is easy for the report to be only partly acted on before the business assumes it is covered until the next one. Continuous penetration testing closes that gap by testing throughout the year, often as part of a penetration testing as a service (PTaaS) subscription. 

 

How Much Does Penetration Testing Cost?

A penetration test can cost anywhere from a few thousand pounds to well over £20,000, as we covered in our breakdown of how much an MSP costs. It is also not always included in an IT provider’s monthly fee. 

The cost of a penetration test depends on how much is being tested, the type of test and how long the testers need. A test of one website costs less than one that covers your whole network, cloud setup and staff. Most testers charge by the day. According to SecuritySenses, UK day rates for thorough testing typically fall between £1,000 and £1,500, so a test that takes five days would cost around £5,000 to £7,500.

When you compare quotes, ask how many testers and days are included, and whether the price covers the report, debrief and a retest after your fixes. Be wary of a quote far below the others. The PCI Security Standards Council describes penetration testing as “essentially a manual endeavor”, so a cheap test that relies only on automated tools is likely a vulnerability scan. An annual test is also a cost you pay again every year, and testing more often multiplies it. On the same day rates, a five-day test every quarter would cost £20,000 to £30,000 a year.

 

What Should You Look for in a Penetration Testing Services Provider?

The quality of a penetration test depends on who carries it out. Before you choose a provider, check them against the points below:

• Recognised accreditation. Look for a CREST-accredited provider. CREST is “an international not-for-profit, membership body representing the global cyber security industry”; testers should also hold individual certifications such as OSCP or CREST CRT.
• Experience with systems like yours. Ask who will actually carry out the test, and whether they have tested businesses with a similar setup, such as Microsoft 365, customer portals or cloud platforms. Independent review sites such as G2 or Gartner Peer Insights show what other clients say. 
• Testing done by people. Ask how much of the test is manual. A provider that mainly runs automated tools may be selling a vulnerability scan.
• A clear scope in writing. A good provider helps you decide what to test, and agrees with you before any testing starts.
• Reporting you can act on. Ask for a sample report. A good one has a short summary for leadership, and ranks each issue by risk with clear steps to fix it. Also ask whether the testers will help you straight away if they find something serious during the test. 
• Retesting. Check whether a retest after your fixes is included or charged separately.
• A clear owner for the fixes. A report only helps if someone acts on it. The ICO found that at Capita, findings from penetration tests “were siloed within business units”, so ask who will fix what the testers find, especially if your testing, IT and security sit with different providers. 
• Care with your data. Testers may see sensitive information, so ask how they store it, when they delete it and whether they will sign a confidentiality agreement.

 

How ThreatSpike Delivers Penetration Testing

ThreatSpike replaces the traditional MSP model with fully managed IT, complete defensive security and unlimited penetration testing, delivered through one platform at one fixed price. Our penetration testing services are run by a CREST-certified team, whose testers average more than 10 years’ tenure and hold certifications including OSCP, OSWE, CISSP and CREST CRT.

Every test is human-led. Testing covers web applications, networks, APIs, cloud environments and staff, through to full red team exercises, and compliance testing maps findings to ISO 27001, Cyber Essentials Plus and PCI-DSS. Each engagement ends with a detailed findings report, a live debrief and guidance on how to fix each issue.

There is no limit on the number of tests, and no day rates or per-test fees within the fixed monthly subscription, so you can test throughout the year instead of waiting for an annual test. Testing runs on the same platform that runs your IT and security, so when a test finds a weakness, the defensive controls are tightened with no separate vendor to brief.

Your security should never be assumed. If your business only tests once a year, talk to our team about what continuous testing could look like.