Penetration testing is an authorized simulated attack on software systems. An ethical hacker uses realistic attack methods to uncover exploitable weaknesses without causing harm, enabling developers to fix them. section 7.4.5
Unlike SAST and DAST, penetration testing is primarily manual and human-led, supported by specialized tools. SAST examines code before execution, while DAST tests the running executable; penetration testing explores whether weaknesses can actually be exploited. section 7.4.5
Use penetration testing to:
- Validate whether software weaknesses create a practical ability to cause harm. section 7.4.5
- Turn discovered weaknesses into remediation work for developers. section 7.4.5
- Support organizational security posture management alongside incident response and red team exercises. section 1.5.2
Approved attack on a software system
An organization hires an ethical hacker to execute approved cyberattacks against its software. The tester identifies the ability to harm but does not cause harm, giving developers evidence for corrective action. section 7.4.5
Figure 7.7 An overview of how security is integrated into each SDLC phase, highlighting critical security tasks associated with planning, development, testing, deployment, and maintenance stages.
Trace where penetration testing fits among security tasks across planning, development, testing, deployment, and maintenance. section 7.4.5
