What is a pentest?

In short

Pentest is short for penetration test. The tester looks for weaknesses in your website, webshop or app and tries whether they can be exploited. The result is a report with the findings, how serious they are, and what to do.

Pentest or automated scan?

An automated scan runs through a list of known checks and produces a long report. It is fast, but it does not understand your site. It cannot see that a customer can open another customer’s order by changing a number in the address.

A pentest also uses tools, but a person assesses the findings, weeds out the false alarms and tests what requires understanding, such as login and user access. You get fewer but real findings, explained so you can act on them.

What happens during a pentest?

• Agreement: you describe what to test, and the owner of the system gives written permission.
• Testing: the tester works within the agreed limits, by default without changing data.
• Report: you get the findings with severity levels and concrete recommendations.
• Retest: once you have fixed the findings, they are tested again.

Why does it need written permission?

Accessing someone else’s systems without permission is illegal, even with good intentions. The written agreement protects both you and the tester and makes clear what may be tested and when.

When does it make sense for a small business?

When your website has logins, customer data or a webshop. When you have had a new site built or made big changes. And as a rule of thumb once a year, because software and threats change.