Digital Lexicon Hub

An authorized simulated attack in which testers try to breach systems with real attacker techniques to assess how well security controls hold.

Customers, insurers and frameworks such as ISO/IEC 27001 often expect independent testing evidence; a well-scoped test shows which weaknesses an attacker could actually exploit, so remediation budget goes where risk is highest.

Before launching a client portal, a company commissions a five-day test of the web app, API and login flow; testers chain an access control flaw with weak session handling to read other clients' invoices, which is fixed and retested before go-live.

A test is a snapshot limited by scope, time and tester skill, so a clean report does not mean a system is secure. It should validate an existing Vulnerability Management process rather than replace continuous scanning and patching.

Engagements start with scoping: targets, test types, rules of engagement, timing and reporting format. Open-box tests share architecture details, while closed-box tests simulate an outside attacker. Testers move through reconnaissance, discovery, exploitation and, where allowed, privilege escalation, using methods described in NIST SP 800-115 and the OWASP Web Security Testing Guide. Reports rate each finding, relate it to the Attack Surface and recommend fixes, followed by retesting.