Penetration Test

The scope is agreed beforehand: externally reachable systems such as the website, email and remote access, the internal network, individual applications, or how staff respond to phishing.

The difference from an automated vulnerability scan: a scan lists known weaknesses. A pentest checks whether they actually open a path into the network – and how far that path leads.

A pentest is a snapshot. It shows the state on one day, for the agreed scope. Whatever is installed, changed or forgotten afterwards is invisible to it.

Its value only materialises once the findings are fixed and re-checked. If you do not yet have ongoing patch management and two-factor authentication, you gain more there than from a test.

Without permission, the same activity is a criminal offence: the Swiss Criminal Code penalises unauthorised access to a data processing system (Art. 143bis SCC). A pentest therefore needs written approval from the system owner, stating scope, time window and contact person.

If systems are hosted by a service provider or in the cloud, their testing rules apply as well: some providers require prior consent, others – Microsoft Azure, for example – only require compliance with their rules. Your own signature does not cover someone else's systems.

We use pentests where the basics are in place and combine them with training for the team. How this fits into protecting your IT is described under IT security.