The gap between feeling secure and knowing you are
Many companies believe their systems are secure because they have never been breached. That is not proof of security, only proof that no one has tried seriously yet. The firewall is in place, antivirus is running, and the IT team applies updates. On paper everything looks fine.
Penetration testing closes the gap between feeling secure and actually knowing. Instead of waiting for a real attacker to prove the weakness, a professional testing team tries to break into your systems with permission and clear rules, then reports exactly how they got in and how far they could move.
Penetration testing is not vulnerability scanning
These two terms are often treated as the same thing, but they differ in a basic way.
Vulnerability scanning is an automated process that checks systems against a database of known flaws and produces a list. It is fast, inexpensive, and can run on a schedule. Its weakness is that a scanner does not know which findings can actually be exploited and which are only theoretical.
Penetration testing involves a person trying to exploit those flaws in reality, chaining several small weaknesses into one damaging attack path, and judging how deep the damage could go. A scanner can tell you a door is unlocked. A tester walks through it, shows what could be taken from inside, and stops just before causing harm.
The two complement each other. Many organizations run a vulnerability assessment regularly and add penetration testing at important moments such as a new application launch or an annual audit.
Three methods: black box, grey box, and white box
Pentest methods differ by how much information you give the testing team before testing begins. This choice shapes the attacker viewpoint and the depth of the findings.
| Method | Information provided | Who it imitates | Best for |
|---|---|---|---|
| Black box | Almost none, just a system name or address | An outside attacker with no initial access | Testing perimeter resilience and external visibility |
| Grey box | Partial, such as an ordinary user account | An employee, partner, or compromised account | Testing what an attacker can do after gaining a foothold |
| White box | Full, including source code and architecture | An insider with complete knowledge | Finding as many gaps as possible in limited time |
Black box most closely resembles a real external attack, but time limits mean testers may not reach the deeper flaws. White box gives the widest coverage because testers do not waste time on what the code already reveals. Grey box sits in the middle and is often the most practical choice, since it reflects the most common scenario of all, an attacker who already holds one valid credential.
Types of penetration testing by target
The method decides how much information is given. The type decides what gets tested. A mature security program usually combines several types based on its risk profile.
Network testing examines infrastructure such as servers, firewalls, and configurations exposed to the internet or the internal network. Web application testing targets flaws in application logic, authentication, and data handling, following references such as OWASP. Mobile application testing assesses how an app stores data and communicates with servers. Social engineering testing tests people rather than machines, through simulated phishing or physical entry attempts. For industrial and manufacturing sectors, OT and ICS testing needs a dedicated approach because a small mistake can halt a production line, something we cover separately in our piece on why the IT playbook fails in industrial environments.
How the pentest process works
A well-run engagement follows a predictable flow, and you have every right to ask for each stage to be explained before signing.
It starts with scoping, where you and the provider agree on which systems are tested, when, and what limits apply. The testers then gather information about the target, map the attack surface, and try to exploit the flaws they find. The stage that decides the value comes at the end, reporting. A good report explains each finding, its severity, the steps to reproduce it, and concrete remediation advice. After your team fixes the findings, the testers run a retest to confirm the gaps are truly closed and the fixes did not create new problems.
Without a retest, you are left holding a list of problems with no assurance they have been resolved.
How often and when to do it
The rule of thumb is to run penetration testing at least once a year and whenever there is a major change to systems, such as a new application launch, a cloud migration, or a change in network architecture.
For banks and financial institutions in Indonesia, this frequency is no longer just good practice. POJK 11/2022 and related circulars require periodic security testing as part of IT risk management. We cover the specific requirements in our guide to pentest obligations for Indonesian banks.
How to choose a penetration testing provider
The quality of a pentest depends heavily on the competence of the people doing it, and marketing language tends to sound the same across providers. A few things are worth checking before you decide.
Ask about tester certifications such as OSCP, OSCE, or CREST, and request a sample redacted report to judge the depth of analysis. Make sure a retest after fixes is part of the scope, not an added charge. Clarify what happens if a tester finds a critical flaw mid-engagement, whether they alert you immediately or wait for the final report. Finally, for regulated organizations, confirm the provider understands the Indonesian compliance context so the report can be used directly during an examination.
Our penetration testing service is run by certified testers with reports in both Indonesian and English, complete with a findings walkthrough and a retest after fixes. If you have never had a serious security test, the best starting point is a short conversation about which systems would hurt most if they stopped working.