Topic · how a test runs
Seven phases, from scope to retest.
A penetration test runs in seven phases: scoping, rules of engagement, reconnaissance, vulnerability analysis, exploitation, reporting, and remediation with a retest. Two of them decide most of the value, and both happen before any testing: the scope, and the rules you sign.
The phases, and what you do in each
| # | Phase | What happens | Your part |
|---|---|---|---|
| 1 | Scoping | Agree what is tested: applications, API endpoints, IP ranges, cloud accounts, roles. This sets the price. | List assets and roles; say what must not be touched. |
| 2 | Rules of engagement | Dates, hours, allowed techniques, stop conditions, contacts and data handling, signed with written authorisation. | Name an emergency contact; warn your hosting provider if required. |
| 3 | Reconnaissance | The tester maps the target: pages, endpoints, hosts, technologies, exposed information. | Provide accounts and documentation if the test is grey box. |
| 4 | Vulnerability analysis | Automated scanning plus manual review to find candidate weaknesses. | Nothing, unless asked to confirm something. |
| 5 | Exploitation | The tester tries to exploit and chain weaknesses to prove impact, within the rules. | Watch for the agreed notices on critical findings. |
| 6 | Reporting | Findings with severity, evidence, impact and fixes, plus an executive summary. | Read the report with whoever will fix things. |
| 7 | Remediation and retest | You fix; the tester retests and confirms. Often followed by an attestation letter. | Fix within the retest window your contract gives you. |
Which methodology the report should name
- NIST SP 800-115 groups the work into planning, discovery, attack and reporting; PCI DSS points to it as an industry-accepted approach.
- PTES, the Penetration Testing Execution Standard, spells out the same phases in more detail, from pre-engagement to reporting.
- OWASP WSTG is the usual method for web applications and APIs.
The scope and rules decide what a test can find, and a retest decides whether it ends with fixes or just a list. See what a good report contains and what drives the price.
Questions
What are the phases of a penetration test?
Scoping, rules of engagement, reconnaissance, vulnerability analysis, exploitation, reporting, and remediation with a retest. Standards group them differently (NIST SP 800-115 uses planning, discovery, attack and reporting), but the work is the same.
How long does a penetration test take?
Testing usually takes one to three weeks for a single application or network, plus scoping before and a retest after. Larger or combined scopes take longer.
Which methodology should a firm follow?
Common references are NIST SP 800-115, the Penetration Testing Execution Standard (PTES) and, for web applications, the OWASP Web Security Testing Guide. Ask which one the report will cite.
Sources for this page
- NIST SP 800-115 — Planning, discovery, attack and reporting phases.
- Penetration Testing Execution Standard (PTES) — The detailed phase model from pre-engagement to reporting.
- OWASP Web Security Testing Guide — The web application and API testing method.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "The penetration testing process: seven phases, from scope to retest." Updated November 8, 2026. https://pentestingfirms.com/process/