Quick Answer
A controlled attack on your own systems. Ethical hackers attempt to break in the way a real attacker would, then report what worked. The point is proving whether a weakness is actually exploitable, not just that it exists.
Not the Same as a Vulnerability Scan
This distinction matters commercially, because the two get sold under the same name.
A vulnerability scan is automated. It checks your systems against a database of known weaknesses and produces a list. Fast, inexpensive, and worth running regularly.
A penetration test is a person. They chain findings together, try things a scanner can't, and establish what an attacker could actually reach. Slower, considerably more expensive, and far more informative.
If a quote for a "penetration test" comes back at a few hundred pounds with a next-day turnaround, you're buying a scan.
What Can Be Tested
External network — internet-facing systems: firewalls, VPN gateways, websites, remote access
Internal network — how far someone could move after getting in
Web applications — authentication flaws, insecure configuration, input handling
Cloud — misconfiguration in cloud-hosted environments
Wireless — weak encryption and unauthorised access
Social engineering — controlled phishing against your staff
Fix the Known Problems First
A pen test on an environment with unpatched systems and partial MFA will tell you what you already suspect, at considerable cost. Testing is most valuable once the obvious gaps are closed — otherwise you're paying a specialist to find them for you.
Example Scenario
A 250-person financial services firm wanted to strengthen its position before a cyber insurance renewal. An external and internal test found outdated software, excessive user permissions, and a vulnerable web application. PureStack worked with the internal IT team to prioritise remediation, then retested to confirm the issues were resolved.
How PureStack Runs Your Penetration Test
We scope the test to what matters in your environment, run it using recognised methodologies, report findings with practical remediation steps, and retest to confirm the fixes hold.