What is a penetration test?

A penetration test (pen test) is an authorized simulated cyberattack on a system, network, or application to identify security vulnerabilities before malicious actors do. Types: Black box: tester has no prior knowledge (simulates an external attacker). White box: tester has full access to source code, architecture, credentials. Grey box: partial knowledge (common in practice). Phases: (1) Reconnaissance: gather information. (2) Scanning: identify open ports, services, vulnerabilities. (3) Exploitation: attempt to exploit findings. (4) Post-exploitation: determine impact and lateral movement. (5) Reporting: document findings with severity and remediation. Tools: Metasploit, Burp Suite, Nmap, Nikto, Nessus, OWASP ZAP. Distinct from vulnerability scanning (automated, no exploitation). Results must be addressed by developers.