Scanners find known weaknesses; testers find out what they are worth. A tester takes the flaws a scanner lists, the ones it cannot see, and the human and process weaknesses around them, and chains them the way an attacker would: a low-severity information leak that reveals a username format, a password policy that permits a guessable pattern, a service that trusts anything from inside the network. The result is a demonstration of what a real attacker could reach and a report that says so in terms a decision-maker can act on. Everything about the discipline follows from two facts: the tester has permission, and the tester has to write it down.
Authorisation is the boundary of the profession
A written statement of what may be tested, when, by whom, and what is out of bounds is what separates a penetration test from a crime. Testers who find a way into a system that turns out to belong to a third party stop, document, and report; they do not continue because it was interesting. Every offensive certification, from the vendor-neutral penetration testing exam to the ethical-hacker credential, spends real weight on this, and self-taught candidates who learned on practice labs consistently fail exactly those questions.
| Kind | The tester knows | Answers |
|---|---|---|
| Black box | Nothing beyond the target | What an outside attacker with no inside knowledge could do |
| Grey box | Some documentation or a low-privilege account | What a compromised user or an informed outsider could do |
| White box | Everything: source, architecture, credentials | Where the flaws actually are, most efficiently |
| Red team | The objective, and as little else as possible | Whether the defenders notice and respond; tests the team, not only the system |
| Bug bounty | Public rules and rewards | What many independent testers find over time, at the cost of noise |
The report divides good testers from tool operators. It states the scope and what was excluded, so a reader knows what the findings do not cover. It ranks findings by what they would let an attacker do in this organisation, not by a generic score. It explains each one so that the person who has to fix it understands the mechanism, and it proposes a fix that fits the system rather than a generic remediation line. A good report can be handed to an engineer and a board member and be useful to both; a bad one is a scanner's output with a logo.