The ultimate guide to penetration testing

Last updated 13 August 2026

Penetration testing (also called pen testing) is an authorised, simulated cyberattack designed to identify and safely exploit security vulnerabilities before malicious attackers do. Unlike a vulnerability assessment, penetration testing demonstrates how an attacker could gain access, what systems could be compromised, and the business impact of those weaknesses.

At The Missing Link, our CREST-accredited penetration testers perform infrastructure, web application, API, cloud, wireless and internal network penetration testing for organisations across Australia. As one of Australia's few CVE Numbering Authorities (CNAs), we actively identify and responsibly disclose newly discovered vulnerabilities, giving us first-hand insight into how attackers exploit modern environments.

Whether you're assessing your cyber security posture, meeting compliance requirements, or validating existing security controls, this guide explains what penetration testing is, how it works, when you should perform it, and how to choose the right approach for your organisation.

In this guide:

• What is penetration testing

• Why penetration testing matters

• The different types of penetration tests

• How penetration testing works

• Vulnerability assessments vs penetration testing

• How often penetration testing should be performed

• The benefits of penetration testing

• What to look for in a penetration testing provider

  ---

Why our perspective is different

Our Offensive Security team doesn't just assess known vulnerabilities; we also help discover new ones.

Through our work as one of Australia's few CVE Numbering Authorities (CNAs), we've published more than 100 Common Vulnerabilities and Exposures (CVEs) through responsible vulnerability disclosure. This work helps software vendors identify and remediate security flaws before they become widespread threats, while giving our consultants first-hand experience researching emerging attack techniques and vulnerability disclosure.

That experience complements the practical knowledge we've gained from delivering penetration testing engagements across Australian organisations, giving us a perspective that extends beyond identifying known vulnerabilities to understanding how new ones are discovered, validated and remediated.

What is penetration testing?

Penetration testing goes beyond identifying vulnerabilities. It simulates the techniques, tools, and behaviours used by real attackers to determine whether weaknesses can be exploited and what impact they could have on your organisation.

Unlike automated vulnerability scanning, which reports potential security issues, penetration testing validates those findings by attempting to exploit vulnerabilities in a controlled and authorised manner. This helps organisations distinguish between theoretical risks and vulnerabilities that pose a genuine business threat.

A penetration test can assess a wide range of environments, including:

• • External infrastructure

  • Internal networks

  • Web applications

  • APIs

  • Cloud environments

  • Wireless networks

  • Mobile applications

This hands-on approach helps organisations:

• • Identify weak points across their environment

  • Understand how vulnerabilities could be exploited in practice

  • Prioritise remediation based on real business risk

  • Validate existing security controls

  • Strengthen their resilience against real-world attack scenarios

Ultimately, the goal of penetration testing isn't simply to produce a list of vulnerabilities. It's to understand how an attacker could compromise your environment and provide clear, practical recommendations to reduce cyber risk.

Why penetration testing matters

Cyber attackers don't just look for vulnerabilities; they look for weaknesses they can exploit to gain access to sensitive systems, move laterally through networks, and disrupt business operations.

Penetration testing helps organisations understand whether their existing security controls can withstand these real-world attack techniques. Rather than identifying theoretical risks, it demonstrates which vulnerabilities are genuinely exploitable, how they could be chained together, and the potential business impact if left unaddressed.

Regular penetration testing can help organisations:

• • Reduce the risk of cyber attacks and data breaches.

  • Validate the effectiveness of existing security controls.

  • Prioritise remediation based on real business risk.

  • Support compliance with industry standards and customer requirements.

  • Improve cyber resilience by identifying weaknesses before attackers do.

Cyber threats continue to impact organisations of all sizes. According to the Australian Cyber Security Centre (ACSC), cybercrime reports increased by 23% in the last financial year, highlighting the growing volume of attacks targeting Australian businesses 

While the threats vary with an organisation's size and complexity, the objective remains the same: identify exploitable weaknesses before attackers do.

As cyber threats continue to evolve, penetration testing has become an essential part of a proactive cyber security programme. Rather than responding to incidents after they occur, organisations can identify, prioritise and remediate exploitable weaknesses before they become real security incidents. 

Penetration testing vs vulnerability assessments

Although they're often used together, penetration testing and vulnerability assessments serve different purposes.

A vulnerability assessment identifies known security weaknesses across your environment using automated tools. It provides a broad view of potential risks and is well suited to ongoing monitoring.

Penetration testing builds on those findings by actively attempting to exploit identified vulnerabilities in a controlled and authorised manner. Rather than identifying what might be vulnerable, it demonstrates how an attacker could gain access, what systems could be compromised, and the potential business impact if those weaknesses remain unaddressed.

Figure: Vulnerability assessments identify potential risks, while penetration testing validates how those risks can be exploited in real-world scenarios. 

The strongest security programs combine both approaches. Vulnerability assessments provide continuous visibility into emerging weaknesses, while penetration testing confirms whether those weaknesses represent genuine business risk.

At The Missing Link, we integrate both approaches into our cyber security strategies, giving you visibility across immediate risks and deeper, more complex attack paths. This enables you to prioritise remediation, validate security controls, and make more informed decisions about strengthening your security posture.

Types of penetration testing

Penetration testing is not a one-size-fits-all assessment. Different types of penetration tests are designed to evaluate specific systems, technologies and attack scenarios, helping organisations identify exploitable weaknesses across their entire environment.

The right approach depends on your technology landscape, business objectives and risk profile. Many organisations combine multiple types of penetration testing to gain a comprehensive understanding of their security posture.

Network penetration testing

Network penetration testing evaluates the security of both internal and external network environments. Attackers commonly target
network vulnerabilities to gain unauthorised access, disrupt services, or move laterally across systems.

It typically includes:

• External network testing, which assesses internet-facing systems such as firewalls, servers and routers for vulnerabilities including misconfigurations, weak credentials and unpatched software. 
  
  
• Internal network testing, which evaluates what an attacker could achieve after gaining access to your internal network, including privilege escalation, network segmentation weaknesses and lateral movement. 
  

This type of testing helps organisations validate the effectiveness of their network security controls and identify opportunities to strengthen their overall security posture. 

Web application penetration testing 

Web applications are among the most common targets for cyber attackers because they often process sensitive business and customer data.

A web application penetration test evaluates how well an application withstands real-world attacks by identifying vulnerabilities such as:

• • SQL injection

  • Cross-site scripting (XSS)

  • Authentication and session management weaknesses

  • Access control vulnerabilities

  • Business logic flaws

Rather than simply identifying vulnerabilities, the assessment demonstrates how those weaknesses could be exploited and the potential business impact if left unresolved.

API penetration testing

Application Programming Interfaces (APIs) are the backbone of modern applications, enabling communication between cloud platforms, mobile applications, third-party services, and internal systems. Because they often expose sensitive functionality and data, APIs have become an increasingly attractive target for attackers.

API penetration testing evaluates how effectively your APIs protect data and enforce security controls by identifying vulnerabilities such as:

• • Broken authentication

  • Broken authorisation

  • Excessive data exposure

  • Injection attacks

  • Security misconfigurations

  • Business logic vulnerabilities

Rather than simply identifying technical weaknesses, API penetration testing demonstrates how an attacker could exploit exposed endpoints to access sensitive information, escalate privileges or compromise connected systems.

Where AI-enabled applications or large language models (LLMs) are in scope, penetration testing can also assess emerging AI-specific attack vectors such as prompt injection, insecure API integrations and excessive permissions.

Wireless penetration testing

Wireless penetration testing evaluates the security of Wi-Fi networks and wireless infrastructure by identifying weaknesses in encryption, authentication and network configuration.

Common vulnerabilities include:

• • Weak or outdated encryption protocols

  • Poor network segmentation

  • Misconfigured wireless access points

  • Weak authentication controls

  • Insecure guest wireless networks

If left unaddressed, these weaknesses can allow attackers to intercept communications, gain unauthorised access to internal systems or establish a foothold for further attacks.

Wireless penetration testing validates whether your wireless security controls can withstand real-world attack techniques and provides practical recommendations to strengthen the security of your wireless environment.

Social engineering testing

Technical controls alone cannot prevent every cyber attack. Social engineering testing evaluates how employees, contractors and business processes respond to real-world attack techniques.

Assessments may include:

• • Phishing simulations

  • Spear phishing

  • Telephone-based attacks (vishing)

  • Impersonation attempts

  • Credential harvesting exercises

These assessments help organisations identify opportunities to strengthen security awareness and improve their overall cyber resilience.

Physical penetration testing

Cyber security extends beyond digital systems. Physical penetration testing evaluates how effectively physical security controls prevent unauthorised access to facilities, systems and sensitive information.

Testing may include:

• • Attempting to access restricted areas

  • Testing physical access controls

  • Evaluating surveillance and monitoring controls

  • Identifying weaknesses in building security

This type of assessment is particularly valuable for organisations operating critical infrastructure or handling sensitive information.

Most organisations benefit from combining multiple penetration testing approaches rather than relying on a single assessment. The right combination depends on your environment, regulatory requirements, business objectives and overall cyber security strategy.

How does penetration testing work?

The penetration testing process explained

Penetration testing follows a structured methodology that reflects how real attackers identify, exploit and move through vulnerable environments. While every engagement is tailored to an organisation's objectives, technology and risk profile, most penetration tests follow the same five core phases. 

The five phases of a penetration test

1. Planning and reconnaissance

The first phase establishes the scope, objectives, and rules of engagement for the penetration test.

Reconnaissance combines both passive and active information gathering to identify potential entry points before testing begins.

This includes:

• • Passive reconnaissance: Collecting publicly available information such as domain records, employee information, exposed services, and other open-source intelligence (OSINT).

  • Active reconnaissance: Interacting directly with systems to identify open ports, running services, technologies, and potential vulnerabilities.

The objective is to build an accurate picture of the target environment before attempting exploitation.

2. Scanning and identifying entry points

Once reconnaissance is complete, testers begin scanning the environment to identify potential attack paths and map the network.

Common tools used during this phase include:

• • Nmap for network discovery and port scanning.

  • Nessus for identifying known vulnerabilities.

  • OpenVAS for detecting security misconfigurations and weaknesses.

Automated tools accelerate discovery, but they don't tell the whole story. Manual validation helps eliminate false positives, verify findings, and prioritise vulnerabilities that represent genuine business risk.

3. Exploitation: Simulating real-world attacks

After vulnerabilities have been validated, testers attempt to exploit them in a controlled and authorised manner.

Depending on the environment, this may include techniques such as:

• • SQL injection

  • Cross-site scripting (XSS)

  • Authentication bypass

  • Privilege escalation

  • Exploitation of misconfigurations

The objective isn't simply to prove that a vulnerability exists. It's to demonstrate what an attacker could realistically achieve if the weakness remained unaddressed.

Understanding the attack path

Figure: Example attacker pathway, from initial breach through to data access 

Successful attacks rarely involve a single vulnerability. Instead, attackers often chain multiple weaknesses together to achieve their objectives.

A typical attack path may involve:

• • Initial compromise

  • Lateral movement

  • Privilege escalation

  • Access to sensitive systems or data

Understanding these attack paths helps organisations prioritise remediation based on real-world risk rather than individual vulnerabilities in isolation.

4. Post-exploitation: Understanding the impact

Once access has been established, testers assess how far an attacker could progress within the environment.

This typically includes evaluating:

• • Persistence mechanisms

  • Lateral movement opportunities

  • Privilege escalation paths

  • Access to sensitive systems and business-critical data

This phase demonstrates the potential business impact of a successful attack, helping organisations understand not only how an attacker could gain access, but what they could achieve once inside.

5. Reporting: Turning findings into action

The final phase transforms technical findings into practical recommendations.

A penetration testing report should help organisations understand what was exploited, why it matters, and what to do next.

A comprehensive report typically includes:

• • A detailed explanation of each vulnerability.

  • Evidence showing how vulnerabilities were identified and exploited.

  • The potential technical and business impact.

  • Risk or severity ratings to support prioritisation.

  • Clear, practical remediation recommendations.

At The Missing Link, every penetration testing report explains each vulnerability, its technical and business impact, how it was exploited, and practical remediation steps, because a report that doesn't drive action isn't worth the engagement.

In summary: Penetration testing doesn't simply identify vulnerabilities. It demonstrates how attackers could exploit them, what business impact those weaknesses could have, and how organisations can reduce cyber risk before those vulnerabilities become real security incidents.

How often should penetration testing be performed?

Why regular testing is essential

Cyber threats, technology environments and business systems are constantly changing. A penetration test reflects your organisation's security posture at a specific point in time, but new vulnerabilities can emerge as applications are updated, infrastructure changes and attackers develop new techniques.

According to the Verizon Data Breach Investigations Report, exploitation of vulnerabilities remains one of the leading methods attackers use to gain initial access. This reinforces the importance of validating security controls on an ongoing basis rather than relying on historic test results.

Regular penetration testing, combined with ongoing vulnerability assessments, helps organisations identify newly introduced risks, validate security improvements and maintain confidence that their defences remain effective as their environment evolves.

How often should you test?

There is no single testing schedule that suits every organisation. The ideal frequency depends on your industry, regulatory obligations, technology environment and how frequently your systems change.

As a general guide:

Regular penetration testing, combined with ongoing vulnerability assessments, helps ensure your security controls continue to perform as your organisation evolves. Rather than relying on a point-in-time assessment, organisations that test regularly can identify newly introduced vulnerabilities, validate security improvements and reduce the likelihood of successful cyber attacks. 

Aligning Penetration Testing with security frameworks

Many organisations use penetration testing to help validate security controls and support compliance with recognised cyber security frameworks. While penetration testing alone does not achieve compliance, it provides valuable evidence that security controls are operating effectively under real-world conditions. 

How penetration testing supports common security frameworks  

Penetration testing helps organisations demonstrate that security controls are operating as intended while supporting compliance with recognised security frameworks. 

Penetration testing and regulatory compliance

For many organisations, penetration testing is not simply a security best practice; it's also an important part of meeting regulatory and industry obligations.

Examples include:

• • ISO 27001, where penetration testing helps validate the effectiveness of implemented security controls.

  • PCI DSS, which requires regular penetration testing for organisations processing payment card data.

  • APRA CPS 234, which expects regulated financial institutions to regularly test the effectiveness of information security controls.

  • Australian Privacy Principles (APPs), where organisations handling sensitive personal information benefit from regularly validating the security of their systems.

Regular penetration testing assures that security controls continue to perform as intended as technology environments evolve.

Key benefits of penetration testing

How penetration testing strengthens your cyber defences

Penetration testing helps organisations identify exploitable vulnerabilities, reduce cyber risk and continuously improve their security posture. By simulating real-world attacks, it provides practical insight into how attackers could compromise your environment and where security controls can be strengthened. 

The key benefits include:

Figure: The four primary business benefits of regular penetration testing. 

1. Identifying unknown vulnerabilities

Even mature IT environments can contain hidden weaknesses. Penetration testing uncovers vulnerabilities that may not be identified through automated scanning alone, allowing organisations to remediate them before attackers have the opportunity to exploit them.

2. Preventing costly breaches and downtime

Cyber attacks can lead to financial loss, operational disruption and reputational damage. By identifying exploitable weaknesses early, penetration testing helps reduce the likelihood of successful attacks, minimises downtime and strengthens business continuity.

3. Improving incident response

Penetration testing helps organisations evaluate how effectively they detect, investigate and respond to security incidents.

By exposing gaps in monitoring, alerting and response processes, organisations can strengthen incident response plans, improve operational readiness and respond more effectively when a real attack occurs.

4. Enhancing security maturity

Cyber security is an ongoing process rather than a one-time activity.

Regular penetration testing validates the effectiveness of existing security controls, identifies opportunities for continuous improvement and supports security frameworks such as the ASD Essential Eight by providing practical evidence that controls are operating as intended.

Rather than viewing penetration testing as a one-off security exercise, organisations should consider it an ongoing investment in cyber resilience. Regular testing helps reduce risk, support compliance, improve security maturity and provide confidence that security controls remain effective as technology environments and threats continue to evolve.

How to get started with penetration testing

Getting started with penetration testing doesn't need to be complex. A structured approach helps you identify the areas of greatest risk, define the right scope, and ensure testing delivers meaningful business outcomes. 

Step 1: Understand your security priorities

Begin by identifying the systems, applications, and data that are most important to your organisation.

Consider:

• • Business-critical systems

  • Internet-facing applications

  • Sensitive or regulated data

  • Recent infrastructure or cloud changes

  • Compliance obligations

Understanding these priorities helps ensure penetration testing focuses on the areas that present the greatest risk.

Step 2: Define the scope

Not every system needs to be tested at once.

A well-defined scope considers:

• • Business risk

  • Technology complexity

  • Regulatory requirements

  • Available budget

  • Organisational priorities

Clearly defining the scope helps ensure testing delivers practical, actionable outcomes.

Step 3: Make penetration testing an ongoing program

Penetration testing should form part of an ongoing cyber security strategy rather than being treated as a one-off assessment.

Regular testing helps organisations:

• • Identify newly introduced vulnerabilities.

  • Validate existing security controls.

  • Confirm remediation activities have been successful.

  • Adapt to changing technology and evolving threats.

As your environment changes, your testing program should evolve with it.

The Missing Link’s penetration testing process

Every engagement follows a structured methodology designed to deliver clear findings, practical remediation advice and measurable security improvements. 

Figure: The Missing Link’s penetration testing process, from consultation through to post-test support. 

This structured approach ensures every engagement delivers more than a list of vulnerabilities. It provides a clear understanding of your organisation's real-world risk together with practical recommendations that help strengthen your security posture over time. 

Securing your future with penetration testing

Cyber threats continue to evolve, making proactive security more important than ever.

Penetration testing helps organisations validate their security controls under realistic attack conditions, identify exploitable weaknesses before attackers do and prioritise remediation based on genuine business risk.

Whether you're meeting compliance requirements, protecting cloud environments or improving cyber resilience, regular penetration testing provides confidence that your security controls continue to perform as intended as your technology environment evolves.

Effective penetration testing isn't simply about identifying vulnerabilities. It's about understanding how attackers could exploit them, what business impact they could have, and what actions should be taken to reduce risk.

FAQs

Ready to take the next step?

Whether you're planning your first penetration test or looking to improve an existing testing program, our team can help you identify the right approach for your environment, business objectives and risk profile.

Speak with one of our penetration testing specialists about a tailored assessment designed around your organisation's needs.