A straightforward answer for anyone new to the term, or scoping their first test and trying to understand exactly what they're buying.
Penetration testing is an authorized, simulated attack on your systems, designed to show how far a real attacker could actually get and what damage they could realistically do — not just list potential weaknesses in the abstract.
It's active and hands-on: a real person attempting real techniques against your systems, within boundaries you've agreed to in advance, rather than a passive review or an automated tool running unattended.
An automated scan flags things that look vulnerable based on version numbers and known signatures. A penetration test proves whether they actually are vulnerable, by attempting real exploitation under controlled conditions and with your explicit authorization.
This distinction matters because plenty of flagged "vulnerabilities" turn out to be non-exploitable in practice due to compensating controls elsewhere in the environment — and conversely, some genuinely dangerous attack paths only reveal themselves when someone actively tries to chain several smaller issues together.
Rules of engagement are agreed in writing before testing starts specifically to manage risk to your live systems — including which systems are in scope, which techniques are off-limits, and what testing windows apply to anything sensitive or business-critical.
You'll typically have a point of contact who can be reached in real time during testing, in the rare case something unexpected happens, and testing can be paused or adjusted if a system starts behaving unexpectedly.
Rules of engagement are agreed in writing before testing starts specifically to manage that risk — including which systems are in scope, what techniques are off-limits, and testing windows for anything sensitive.
Testing is designed to avoid disruption, and destructive techniques are excluded from scope unless specifically agreed to in advance. Testing windows can also be scheduled around low-traffic periods for anything particularly sensitive.
A written report detailing findings, their real-world impact, and remediation guidance, plus a live debrief where you can ask questions directly rather than just reading a document cold.