Understanding penetration testing

Penetration tests (or pentests for short) are simulated cyberattacks that are designed to find vulnerabilities in computer networks and applications. The biggest difference between a pentest and an actual cyberattack is that the former is conducted with the full consent of the owner of the computer or network, whereas the latter isn’t.

As a pentester or red team member, not only will you need consent from the owner of the target you’re testing, but you’ll also have to sign a legal agreement that explains in detail what you’re allowed to do, what you’re forbidden from doing, and the scope of your pentest. This applies whether you’re an employee of the organization being pentested, a third-party contractor of the organization being pentested, someone who conducts simple one-off pentests, or a red team member who pentests as part of your red team engagements.

Whether or not an organization has a red team...