Glosario de ciberseguridad
What is penetration testing (pentesting)?
Penetration testing is a controlled security audit in which an authorised team simulates a real attack against an organisation's systems to uncover vulnerabilities before a malicious actor does.
Phases of a pentest
- Reconnaissance: gathering public and technical info about the target.
- Scanning and enumeration: discovering services, ports and versions.
- Exploitation: leveraging vulnerabilities found.
- Post-exploitation: privilege escalation, lateral movement, persistence.
- Report: prioritised findings and remediation plan.
Pentesting types
- Black box: no prior info — simulates an external attacker.
- Grey box: partial credentials or knowledge.
- White box: full access to code and architecture for a thorough review.
- By scope: web, mobile, internal infrastructure, cloud, IoT, social engineering.
Pentesting vs vulnerability scanning
A vulnerability scan is automated and broad. A pentest is manual and deep: it chains vulnerabilities to demonstrate real impact. A well-implemented Zero Trust architecture dramatically reduces the scope of findings because it blocks lateral movement.