Penetration Testing
A controlled, authorized attempt to exploit vulnerabilities in a system, network, or application. Penetration tests reveal what an attacker could actually achieve, not just what is theoretically possible.
Why it matters
Vulnerability scans tell you what might be wrong. Penetration tests prove what is exploitable. The distinction matters because resources are finite and not every vulnerability is a real threat in your specific environment. Pentest results provide the evidence auditors want to see: proof that you actively test your defenses rather than just documenting them. SOC 2, ISO 27001, and PCI DSS all expect regular penetration testing.
In practice
Penetration tests are typically performed annually or after significant changes, by internal teams or external specialists. They produce findings ranked by severity, with reproduction steps and remediation guidance. In vucavoid, pentest findings are tracked through the findings module with severity ratings, deadlines, and ownership. Evidence from penetration tests attaches directly to the controls they validate, creating a verifiable link between testing and control effectiveness.