Penetration Testing Methodology Walkthrough

What actually happens during a pen test.

A professional penetration test is not someone sitting in a dark room randomly attacking your systems. It's a structured, methodical process with defined phases, clear deliverables, and constant communication. Every step has a purpose, every decision is documented, and the entire engagement follows a methodology refined through thousands of real-world assessments.

But unless you've been through the process before, it can feel opaque. You sign a contract, someone tests your systems for a week, and a report appears. What happens in between? What does the tester actually do all day? How do they decide what to focus on? And how does the process ensure that nothing important gets missed?

This article walks through every phase of a typical engagement in plain English — no jargon, no assumptions, no skipped steps. Whether you're commissioning your first pen test or your fiftieth, this is what the process looks like from the inside.

Pre-engagement — setting the foundations.

Every engagement begins with a conversation — not a scan. The pre-engagement phase is where we understand what you need, why you need it, and how to structure the test so it delivers maximum value. Nothing is tested until this phase is complete and both parties have signed off.

Pre-engagement typically takes one to two weeks. It feels like admin. It isn't — it's the phase that determines whether the test produces actionable intelligence or just generates noise.

Reconnaissance — seeing what the attacker sees.

Before the tester sends a single probe to your systems, they spend time gathering intelligence from public sources — exactly as a real attacker would. This passive reconnaissance is invisible to you: no logs are generated, no alerts fire, no packets touch your network.

Reconnaissance typically occupies the first day of testing — sometimes more for large or complex estates. Every hour invested here saves multiple hours later by ensuring the tester focuses on the right targets rather than probing blind.

Vulnerability discovery — finding the weaknesses.

With the attack surface mapped and prioritised, the tester begins systematically identifying vulnerabilities across the in-scope targets. This phase combines automated scanning with manual investigation — the scanner catches known issues at scale, and the human tester finds the context-dependent, logic-based, and chained vulnerabilities that automation misses.

The nature of testing differs by target type, but the principle is consistent: understand what the system does, then systematically test whether it can be made to do something it shouldn't.

Every potential vulnerability is noted but not yet confirmed. The tester builds a working list of hypotheses: "this parameter might be injectable," "this access control might be bypassable," "this service account might be crackable." The next phase confirms or disproves each one.

Exploitation — proving the risk is real.

Exploitation is the phase that separates a penetration test from a vulnerability assessment. Where a vulnerability assessment says "this might be exploitable," exploitation proves that it is — by actually doing it, under controlled conditions, with the client's explicit authorisation.

This is not reckless. Exploitation in a professional pen test is careful, documented, and proportionate. The tester's goal is to demonstrate impact with the minimum disruption necessary. They're not trying to break things — they're trying to prove that an attacker could break things, so that you can fix the vulnerability before someone with less restraint finds it.

Exploitation converts abstract vulnerability descriptions into concrete business risk. "SQL injection in the search field" becomes "an attacker can extract your entire customer database." "Kerberoastable service account" becomes "an attacker can take over your Active Directory in under two hours." The finding is the same; the impact statement changes everything.

Post-exploitation — how far can we go?

Once an initial foothold is established — a compromised account, a web shell, access to the internal network — the question becomes: what can an attacker do from here? Post-exploitation simulates the actions a real attacker would take after the initial breach, testing whether your internal defences contain the damage or allow it to spread.

This phase is where penetration testing most diverges from vulnerability scanning. A scanner stops at "this service has a known vulnerability." Post-exploitation asks: "if this service is compromised, can the attacker reach the domain controller? Can they access the finance system? Can they exfiltrate client data? Can they deploy ransomware?" The answers to these questions are what the board actually needs to hear.

Post-exploitation is typically where the engagement's most impactful findings emerge. The initial vulnerability might be a medium-severity issue on its own — but combined with weak segmentation, cached credentials, and absent monitoring, it becomes a pathway to complete organisational compromise.

Reporting — translating findings into action.

The report is the deliverable. It's the tangible output of the entire engagement — the document that drives remediation, informs risk decisions, satisfies compliance requirements, and gets presented to the board. A brilliant test with a poor report is a wasted test.

Our reports are structured to serve multiple audiences. The executive summary is written for the board and senior leadership: plain English, business impact, strategic recommendations. The technical findings are written for the security and IT teams who will carry out the remediation: precise, reproducible, and prioritised by real-world risk rather than generic CVSS scores.

The report is delivered within five working days of testing completion. It's not a scanner export with a logo — it's a hand-written document, quality-reviewed by a second consultant, designed to be read by humans and acted upon.

Debrief — making sure the findings land.

A report alone isn't enough. Findings need context, questions need answering, and the people responsible for remediation need to understand not just what to fix but why it matters and how the attacker exploited it.

The debrief is a structured walkthrough of the report with the tester who conducted the engagement. It's interactive — not a presentation but a conversation.

Remediation and retest — closing the loop.

The pen test identified the vulnerabilities. The debrief ensured everyone understands them. Now the organisation fixes them — and the tester comes back to verify that the fixes work.

The retest closes the loop. Without it, you've identified problems but you haven't confirmed they've been fixed. A pen test without a retest is a diagnosis without a follow-up appointment.

End to end in one view.

Here's the complete engagement lifecycle, from first conversation to final retest, with realistic timeframes:

The client's perspective, day by day.

From your side, the engagement should feel structured, communicative, and transparent. Here's what a well-run engagement looks like from the client's seat:

If any of these touchpoints are missing from your engagement — if you don't hear from the tester during testing, if the report arrives without a debrief, if there's no retest option — that's a signal that the process may not be as thorough as it should be.

The bottom line.

A professional penetration test is an eight-phase process: pre-engagement, reconnaissance, vulnerability discovery, exploitation, post-exploitation, reporting, debrief, and retest. Each phase builds on the last, and skipping any one of them reduces the value of all the others.

The methodology isn't complicated, but it is rigorous. It ensures that nothing important is missed, that every finding is verified and contextualised, that the report serves every audience from the board to the developer, and that remediation is confirmed rather than assumed.

The best pen test is one where you understand every step of the process — because when you understand the process, you can hold your provider accountable, prepare your teams effectively, and extract maximum value from the engagement.