What is penetration testing? A plain-English guide

A penetration test (or “pen test”) is an authorised, simulated attack on your systems. Skilled testers, often called ethical hackers, try to break in the way a real attacker would, so you can find and fix the holes before someone with bad intentions does.

Penetration test vs vulnerability scan (and DAST)

These are often confused:

	Vulnerability scan / DAST	Penetration test
Who does it	An automated tool	People, helped by tools
What you get	A long list of possible problems	Proven problems, ranked by real risk
False alarms	Common	Removed. Each finding is checked by hand
Business logic flaws	Usually missed	Found, e.g. “can I pay ₦1 for a ₦100,000 order?”
Chaining	No	Yes. Small issues combined into a serious attack

DAST (dynamic application security testing) is an automated scan of a running app. It’s useful between tests, but it doesn’t think like an attacker. The best approach uses both: scans for routine checks, and pen tests for depth.

The main types of penetration test

• Web and app testing: websites, web apps, mobile apps and APIs, usually checked against the OWASP Top 10 list of common weaknesses, plus flaws in how your app works.
• Network testing: your internet-facing systems, your internal network and Wi-Fi.
• People testing (social engineering): fake phishing emails, phone calls and physical access checks, to see whether staff can be tricked.
• Red team exercises: a full, realistic attack with a clear goal, such as “reach the customer database”, to test your detection and response as well as your defences.

Black box, grey box, white box

• Black box: the tester knows nothing at the start, like an outside attacker.
• Grey box: the tester has some access, such as a normal user account. This is the most common and best value.
• White box: the tester sees the code and architecture, for the deepest review.

What happens during a test

1. Scope and rules. You agree in writing what is tested, when, and what is off-limits.
2. Discovery. The testers map your systems and look for weak points.
3. Exploitation. They try to break in, carefully, to prove which weaknesses are real.
4. Reporting. You receive a report with each problem, its risk, proof, and clear steps to fix it.
5. Walk-through. The testers explain the findings to your team.
6. Re-test. After you fix things, they check the fixes really work.

What a good report includes

• A plain-English summary your board or regulator can act on.
• Each finding ranked by risk, with proof such as screenshots or requests.
• Specific fix steps for your engineers, not generic advice.
• What was tested and what wasn’t, so there are no false assurances.

What affects the cost

Price depends on the size and number of systems (pages, API endpoints, IP addresses), the type of test, how deep it goes (grey or white box takes more time), and whether a re-test is included. Be wary of very cheap “pen tests” that are really just automated scans with a logo on the report.

When you need one

• Before launching a new app, website or API.
• When a regulator, investor or partner asks for proof of security.
• After a major change or a security incident.
• At least once a year as routine.

We run penetration tests from Abuja for businesses across Nigeria. Every finding is checked by hand, explained simply, and re-tested for free within 90 days.