What is a pentest?
A pentest (penetration test) is an authorised, controlled attack on systems, networks or applications in which a security specialist finds vulnerabilities and attempts to exploit them, to demonstrate what damage a real attacker could do. Unlike an automated scan, a pentest produces evidence: the tester shows that a weakness genuinely leads to access, data theft or takeover of a system. In an environment with SCADA and PLCs this demands extra care, because a single malformed request can disrupt a physical process.
The aim is to find and fix weaknesses before malicious actors do, while checking whether existing security controls actually work.
🧠 What is tested in a pentest?
A penetration test always targets a defined scope. Common targets are:
- Network - external (from the internet) or internal (from a workstation or guest network)
- Web applications and APIs - often following the OWASP Web Security Testing Guide
- Mobile apps and cloud environments - including the configuration of identities and storage
- Active Directory - a common target for privilege escalation inside a domain
- Industrial systems - SCADA, HMIs, historians, engineering workstations and PLCs
- Social Engineering - for example phishing campaigns or physical access to a building
- Products - a manufacturer tests its own controller or gateway before it goes to market
🔄 What is the difference between black box, grey box, white box and red teaming?
Black, grey and white box describe how much information the tester receives in advance. Red teaming is not a knowledge level but a different exercise: it focuses on an objective and on detection, not on the most complete list of vulnerabilities.
| Form | Tester’s prior knowledge | Strength | Limitation |
|---|---|---|---|
| Black box | None; only a target or IP range | Simulates an external attacker | Much time goes into reconnaissance, less depth |
| Grey box | Limited, e.g. a user account or network diagram | Realistic and efficient; a frequent choice | Assumes an attacker with some access |
| White box | Full: source code, configurations, architecture | Greatest coverage per test day | Less realistic as an attack scenario |
| Red teaming | Varies; works covertly towards a goal | Tests detection and response of the Blue Team | Does not find every vulnerability |
A purple team combines both sides: attackers and defenders work together so that detection rules are improved straight away.
🔧 How does a pentest work step by step?
Methodologies such as PTES, OSSTMM and NIST SP 800-115 (2008) follow roughly the same phases:
- Preparation and scope - targets, systems, test windows, contacts and an emergency stop procedure are agreed in writing and signed.
- Reconnaissance - public information, DNS, network scans with Nmap and an asset inventory.
- Finding vulnerabilities - using scanners such as Nessus or Nikto plus manual analysis, mapped to known CVEs.
- Exploitation - using tools such as Metasploit and Burp Suite to prove that a vulnerability really gives access.
- Post-exploitation - escalating privileges and moving laterally, for example from the office network towards OT, to establish the real impact.
- Reporting - findings with evidence, a risk score (often CVSS, version 4.0 since November 2023) and concrete recommendations.
- Retest - after remediation, verifying that the fixes work.
Scripting in Python, Bash or PowerShell complements the standard tools, and network traffic is often analysed with Wireshark.
🏭 Why is a pentest different in OT?
In OT, availability and safety come first. Older controllers often have a limited network stack and respond unpredictably to scans. NIST SP 800-82 (Revision 2) describes three real cases: a ping sweep on a live SCADA network made a 3-metre robotic arm swing 180 degrees, a ping sweep in a chip fabrication plant hung a system and destroyed USD 50,000 worth of wafers, and an IT pentest at a gas utility strayed into the SCADA network, so that no gas could flow through the pipelines for four hours.
That is why OT has different rules of engagement:
| Aspect | IT pentest | OT pentest |
|---|---|---|
| Priority | Confidentiality of data | Availability and safety of the process |
| Scanning | Active scans are normal | Passive listening first; active scans only sparingly and by agreement |
| Test environment | Often in production | Preferably on a spare installation, test bench or digital twin |
| Test window | Office hours or continuous | During maintenance shutdowns, with operators and process engineers on standby |
| Exploitation | Up to full takeover | On PLCs and the SIS usually demonstrated, not executed |
| Protocols | HTTP, SMB, LDAP | Modbus, DNP3, OPC UA, ProfiNET |
A safe approach is to focus on the IT/OT boundary: can an attacker on the office network reach the OT zones through remote access, the jump server or a misconfigured firewall? That directly tests whether network segmentation according to the Purdue Model works. Fuzzing protocols such as Modbus belongs on a test bench, never on a running installation. Scenarios can be based on MITRE ATT&CK for ICS and current threat intelligence.
🔐 Which standards and laws call for penetration testing?
- IEC 62443-4-1 - requires manufacturers, in practice 5 (security verification and validation), to carry out, among other things, vulnerability testing such as fuzzing (SVV-3), penetration testing (SVV-4) and testing by people independent of the developers (SVV-5).
- IEC 62443-3-3 - requires a system’s security functions to be verified; a pentest is a common way to do so, often during the FAT and SAT.
- NIS2 and the Dutch Cyberbeveiligingswet - require policies and procedures to assess the effectiveness of security measures (NIS2 Article 21(2)(f)). The directive does not name penetration testing explicitly, but a pentest is a common way to demonstrate that effectiveness. The Cyberbeveiligingswet entered into force in the Netherlands on 15 August 2026.
- Cyber Resilience Act - obliges manufacturers to test the security of their products effectively and regularly.
- DORA and TIBER - financial entities designated by their supervisor must, under DORA (applicable since 17 January 2025), have a threat-led penetration test (TLPT) carried out at least every three years. The Dutch TIBER-NL programme of De Nederlandsche Bank started in 2016 and formed the basis for TIBER-EU, which the ECB published in May 2018.
- ISO 27001 - uses technical tests as evidence that controls work, supporting compliance.
Legally, written authorisation from the owner is essential: without it, breaking into a system is a criminal offence (in the Netherlands, computer trespass under Article 138ab of the Criminal Code). Vulnerabilities you discover outside an engagement should be reported through responsible disclosure.
🎯 What does a pentest deliver?
- A report of findings - classified by risk, with a management summary
- Technical evidence - screenshots, logs and reproducible steps
- Recommendations - for patching, configuration and architecture
- Insight into detection - did your SOC see the attack, and how quickly?
- Input for risk management - findings feed vulnerability management and the risk register
A pentest is a snapshot. Combine it with continuous scanning and monitoring, and repeat it after major changes or at least annually for critical systems.
❓ Frequently asked questions
What is the difference between a pentest and a vulnerability scan?
A vulnerability scan searches automatically for known vulnerabilities and produces a list of possible issues. A pentest goes further: a specialist actually attempts to exploit those vulnerabilities and demonstrates their impact. A scan is broad and cheap, while a pentest is deep and manual.
How often should you have a pentest carried out?
For critical systems, at least one pentest a year is common practice, plus an extra test after major changes such as a new application or network connection. Financial entities under DORA may also be designated for a threat-led penetration test that takes place at least every three years.
Is a pentest legal?
A pentest is legal as long as the owner of the systems gives written authorisation in advance and the scope is agreed. Without that authorisation, intruding into a computer system is a criminal offence in the Netherlands and most other countries. A good engagement letter therefore lists the systems, times, methods and contacts.
Can you pentest a live OT production installation?
A pentest on a running OT installation is possible, but only with strict agreements, passive techniques and operators on standby. Active scans can make older PLCs hang or disrupt a process. That is why OT penetration testing is preferably done on a test bench, a spare installation or during a planned shutdown.
What is the difference between a pentest and red teaming?
A pentest tries to find and demonstrate as many vulnerabilities as possible within a fixed scope. Red teaming simulates a specific attacker with a concrete objective and mainly tests whether the organisation detects and responds to the attack. Red teaming therefore suits organisations whose basic security is already in order.
How much does a pentest cost and how long does it take?
The duration of a pentest depends on its scope: a single web application takes a few test days, an extensive IT/OT test or red team exercise several weeks. The cost follows the number of test days. On top of that, allow time for preparation, reporting and a retest.
📌 In summary
A pentest is an authorised, simulated attack that shows which vulnerabilities can really be exploited, so that you can fix them before an attacker does. In OT a pentest requires a cautious, passive approach. As a recurring check it belongs in any cybersecurity strategy and helps you demonstrate compliance with IEC 62443, NIS2 and the Cyber Resilience Act.