Penetration tests are *authorised, legal attempts to defeat an organisation's security controls* and perform unauthorised activities. These tests are time-consuming and require staff who are equally skilled and determined as the real-world attackers that will attempt to compromise the organization. However, they're also the most effective way for an organization to gain a complete picture of their security vulnerability. Penetration testers must take a *very different approach in their thinking*. Instead of trying to defend against all possible threats, they only need to find a single vulnerability that they might exploit to achieve their goals. To find these flaws, they must think like the adversary who might attack the system in the real world. This approach is commonly known as **adopting the hacker mindset**. When conducting a penetration test (or a real-world attack), the *attacker needs to win only once*. They might attempt hundreds or thousands of potential attacks against a target. The fact that an organisation's security *defences block 99.99 percent of those attacks is irrelevant* if one of the attacks succeeds. > [!warning] Cybersecurity professionals need to win every time; attackers need to win only once. Penetration testing *provides us with visibility* into the organisation's security posture that simply *isn't available by other means*. Penetration testing does not seek to replace all the other cybersecurity activities of the organization. Instead, it complements and builds on those efforts. ### Benefits of Penetration Testing - Penetration testing provides us with *knowledge that we can't obtain elsewhere*. By conducting thorough penetration tests, we learn whether an attacker with the same knowledge, skills, and information as our testers would likely be able to penetrate our defences. If they can't gain a foothold, we can then be reasonably confident that our networks are secure against attack by an equivalently talented attacker under the present circumstances. - In the event that attackers are successful, penetration testing provides us with an *important blueprint for remediation*. Cybersecurity professionals can trace the actions of the testers as they progressed through the different stages of the attack and close the series of open doors that the testers passed through. - Penetration tests can provide us with *essential, focused information on specific attack targets*. We might conduct a penetration test prior to the deployment of a new system that is specifically focused on exercising the security features of that new environment. [[Penetration Testing Types]] [[Rules of Engagement]] [[Running the Test]]