Penetration testing and ethical hacking

A penetration test is an attack commissioned by the owner of a system, carried out by someone skilled enough to behave like a real adversary and disciplined enough to stay within what was agreed. The Penetration Testing Execution Standard, the most cited open description of the work, divides an engagement into seven phases. Only two of them are the exploitation people picture. The rest is conversation, research and writing, and the quality of an engagement is usually decided before any tool runs: a vague scope produces a vague report, however skilled the tester.

Vocabulary, and how the two main exams differ

A tester needs the defenders' vocabulary as much as the attackers'. Scoping language (black, grey and white box; in scope and out of scope), the gap between a vulnerability scan and a test, threat modelling, privilege escalation and lateral movement, and the CVSS ratings in which findings are expressed. A red team engagement is related but different: longer, driven by a goal, and also measuring whether the defenders notice. Two exams dominate the entry level of the field. PenTest+ covers the whole engagement and gives real weight to planning and reporting. The Certified Ethical Hacker credential is the name recruiters and public-sector lists request most, and it draws scepticism from practitioners who find it wide rather than deep. Both are largely written exams. Testers judge one another on practical assessments, so anyone aiming at consultancy work should plan for one of those as well.

Why strong hackers write weak tests

The commonest beginner mistake is believing the exploit is the product. Self-taught testers raised on capture-the-flag platforms are often technically sharp and still hand over reports a client cannot use: tool output pasted in bulk, every finding marked critical, no word about business impact. A client is paying for a ranked list of what to fix and why. The second mistake is legal. Practice labs teach that every machine in front of you is fair game; in paid work, touching a single host outside the agreed scope can end a career, and the exams probe that line harder than candidates expect.

Testing is rarely a first job. Most testers arrive from system administration, development or a SOC, because exploiting a system requires knowing how it is normally run. The adjacent topics are application security, where much modern testing happens, and vulnerability management, which is what the client does with your report after you leave. For an early check of aptitude, the free Cisco introduction to cybersecurity covers the ground underneath, and PenTest+ is the natural first exam once ordinary IT work has given you something to test against. Readers who want the defender's view of the same weaknesses should read vulnerability management next.