Penetration testing has been a cornerstone of cybersecurity for decades. For many organisations, it is part of an annual security programme, providing reassurance for boards, evidence for customers and insurers and a demonstration of compliance with regulatory requirements. It is also one of the most commonly purchased cybersecurity services.
Despite its widespread use, penetration testing is actually one of the least consistently defined services in the industry. Two providers can assess the same environment and produce very different reports. One may identify critical vulnerabilities that another overlooks. Recommendations, severity ratings and conclusions can differ significantly, even though both engagements are described as a “penetration test”. This level of inconsistency raises questions around whether an organisation actually knows what it is buying.
The answer is more complicated than it may first seem. A penetration test is not a standardised product with identical or even similar outputs regardless of who performs it. Its quality depends heavily on the tester’s methodology used, the time allocated and, crucially, the scope agreed before the work even begins. These variables mean that the value of a penetration test differs enormously from one provider to another.
Unfortunately, many organisations still purchase penetration testing as if it were a commodity. This means the procurement decisions will often be driven by cost or by the need to satisfy a compliance requirement, instead of by a clear understanding of what the organisation is really trying to achieve. The result is a report that proves that a test has taken place but not necessarily one that provides a meaningful level of insight into the organisation’s real exposure to cyber risk.
That challenge has become even greater as technology environments have evolved. Organisations operate across cloud platforms, SaaS applications, remote devices, third-party services and complex digital supply chains. Many businesses struggle to maintain a complete inventory of their own assets. And if you do not have full visibility of your environment, it is difficult to define the scope of a penetration test, let alone be confident that every important system has been assessed.
This is where the phrase “passing a penetration test” can become misleading. A penetration test only assesses the systems and scenarios that have been agreed upon and are within its scope at a particular point in time. It cannot provide assurance about assets that were omitted, systems deployed after the test, or new vulnerabilities that emerge the following week. Treating the report as proof that an organisation is secure risks creating a false sense of confidence.
Compliance has contributed to this mindset. Many standards and regulations require organisations to demonstrate that security testing has taken place, which is a good thing. However, there is a danger that the objective of the penetration test becomes obtaining the report rather than improving security. Cyber resilience is not measured by whether a penetration test was completed but by whether the findings are understood, prioritised and used to reduce genuine business risk.
But none of this means that penetration testing is obsolete. It is quite the opposite. Independent, expert-led testing is one of the most effective ways of understanding how an attacker could compromise an organisation. What needs to change is the expectation that every penetration test is equivalent, or that a single assessment can provide lasting assurance in an environment that changes continuously.
The future of penetration testing is likely to be more contextual and outcome driven. Rather than asking whether a business has had a penetration test, the focus should be on whether they have tested the systems that matter most, whether the testing reflected realistic attack scenarios and whether the findings have improved their security posture.
Of course, the value of a penetration test has never been the report itself. Its value lies in helping organisations understand where they are vulnerable, why those vulnerabilities matter and what they should do next. If the industry can refocus on those outcomes rather than simply delivering another compliance exercise, then penetration testing has a very strong future.
