A penetration test has six steps: agreeing the scope, the rules, reconnaissance, attack, the report, and the fix with a retest. Most of the work is at the beginning and the end, not in the middle. The core of the test is that the tester actually exploits weaknesses to show where they lead. NIST SP 800-115 describes it this way: a scanner only finds that a flaw may exist, whereas an attack confirms it. The table shows what exactly you do and what the tester does, and when.
- A test has 6 steps: scope, rules, reconnaissance, attack, report, fix with a retest.
- The tester actually exploits weaknesses, a scanner only finds that a flaw may exist (NIST).
- A mere list of weaknesses does not meet the purpose of the test (PCI SSC).
- The risk estimate and the decision on fixes stay with you (NCSC).
| Step | What the tester does | What you do | What comes out |
|---|---|---|---|
| 1. Agreeing the scope | Proposes the boundaries of the test, the types of test and an estimate of work in days. | You bring the risk owners and a technician who knows the system, and you agree to the scope. | A document with the boundaries of the test (NCSC) |
| 2. Rules | Writes down with you what is and is not allowed. | You approve and sign them. | Signed rules, the test has not started yet (NIST) |
| 3. Reconnaissance | Collects public data and scans. | You have a technical contact at hand. | A map of where one can try to get in |
| 4. Attack | Tries to exploit weaknesses and goes further. | The contact picks up the phone. | Verified findings with evidence |
| 5. Report | Describes the findings, their risk and the fix. | You read it and attend the presentation of results. | A report with a summary and findings |
| 6. Fix and retest | Repeats the attacks on the fixed findings. | You estimate the risks and fix. | A supplemented report |
The documents divide the steps differently. NIST speaks of four phases (preparation, reconnaissance, attack, report), NCSC of five steps (start, scope, test, report, follow-up) and the PCI SSC guide of preparation, test and work after the test. The content is the same in all of them.
Steps 1 and 2: scope and rules
NCSC recommends that all risk owners, the technicians who know the system and a representative of the testers take part in scoping. The result is a plan with the boundaries of the test, the types of test, time and work in person-days and the testers' requirements. According to NIST nothing is tested at this step: the rules are set, management approves the plan and the goals are defined. How to prepare these two steps is described in the article on preparation. Which type of test to choose, in the article on black, grey and white box. What the price is made of, in the article on the price.
Step 3: reconnaissance
The tester starts with what can be found out about you from outside. NIST names computer names and IP addresses from public registers and DNS, employees' names and contacts from public websites and the versions of programs that services give away themselves. Then the tester compares what was found with databases of known holes. Manual searching finds new or obscure weaknesses that a scanner misses, but is much slower.
Step 4: attack
NIST calls the attack the heart of the test: the tester tries to actually exploit weaknesses that so far are only suspected. Often the tester does not reach the highest access straight away, but learns more about the network and returns to reconnaissance. Some attacks give higher rights. Then the tester has to find out where they lead. According to NIST most tests look for a combination of weaknesses that gives more access than any of them alone.
A test can also touch people and buildings: NIST gives the example of a phone call in which the tester poses as a support worker and asks for a password. That applies only when it is in the rules.
There is a risk and NIST does not hide it. Systems can be damaged during a test and an experienced tester only reduces that. That is why there are rules, a time window and a contact who stops the test. According to NIST a test can be designed so that the tester stops at the point where the next step would cause damage.
Step 5: the report
The PCI SSC guide is strict: a mere list of weaknesses is not useful and does not meet the purpose of the test. The report should say what was tested, how and with what result. The suggested outline has a summary for management, scope, method, limits of the test, a description of how it went, findings (how a weakness can be exploited, how serious it is, which targets it affects), the tools used and the cleanup after the test. For each finding it should be clear how the severity grade came about. NCSC adds the testers' opinion on how accurately the firm itself knows its weaknesses, and advice on how to improve that.
NCSC wants a severity grade for each finding, for example CVSS, and the tester has to justify any deviation from the usual grade. On its page Lumenax promises a report in Czech with an executive summary, findings ordered by severity and proof that the weakness can be exploited for each finding.
Step 6: after the report your work begins
NCSC is unambiguous here: estimating the risk and deciding on fixes is up to you. The tester may have seen a smaller part of the context and rated a finding lower or higher than you. Your grade should not be used to underestimate the findings. Findings you did not know about should be dealt with first, and you should ask how to catch them yourselves next time. The proposed fix is not the only possible one: instead of a patch a program can sometimes be uninstalled or access to it restricted. According to NCSC, estimating risk and fixing are a business process, not something that can be handed over entirely to the testers.
When a fix is done, the tester verifies it with a retest. What it looks like and when it is mandatory is described in the article on the retest. The tester should also report which accounts it created and which tools it installed, and you delete them (PCI SSC).
When you need a test
In the higher-obligations regime under Act No. 264/2025 Coll., Decree No. 409/2025 Coll. requires a penetration test of technical assets before they are put into operation and on a significant change, where the firm decides on a test for a change based on the results of risk management (§ 11(3)). Regularly after that at least once every 2 years. The results are to be taken into account in risk management. PCI DSS for payment cards requires a test at least every 12 months and after a significant change. Lumenax states that many customers and standards, among them ISO 27001, expect regular testing. You will find the table of obligations of both decrees in the article on the retest.
- Before launchFirst testA penetration test of technical assets before they are put into operation.
- On a significant changeA risk-based testThe firm decides on a test for a change based on the results of risk management (§ 11(3)).
- At least once every 2 yearsRegular testDecree 409/2025 Coll., § 24(5).
- At least once every 12 monthsPayment cardsPCI DSS: a test, and again after a significant change.
What a firm of twenty people does
- Ask the supplier to describe these 6 steps for your case and to give a number of days for each.
- Name one technician as the contact and one person from management who signs the rules.
- Attend the presentation of results. NCSC calls it useful: you can ask about unclear findings.
- For each finding name an owner and a deadline. Check whether the fix reached live operation.
- Order a retest for the whole batch of fixes.
Mistakes that keep repeating
- It ends with the report. NCSC points out that the risk estimate and the decision on fixes remain with you.
- The report is only a machine-generated list. PCI SSC writes that a list of weaknesses does not meet the purpose of the test.
- Findings are underestimated. NCSC explicitly advises that grades should not serve to play findings down.
- Nobody holds the contact. The tester runs into a problem and has nobody to call.
Common questions
Won't a penetration test bring our operations down?
The risk cannot be ruled out. NIST writes that systems can be damaged during a test and an experienced tester only reduces the risk. An agreed window, a contact and the conditions under which the tester stops, written into the rules, help.
How long does a test take?
According to PCI SSC days to weeks, depending on the scope and the size of the environment. Lumenax states that a smaller website usually takes 3 to 5 days of testing. Price and scope are covered in the article on the price.
Will we get something we can understand?
You should. The PCI SSC guide wants a summary for management and technical findings, and NCSC recommends a presentation of results. If you get only a list, according to PCI SSC the purpose of the test has not been met.
Is how people react to a phone call or an email tested too?
Only if it is in the rules. NIST mentions social engineering and physical access as possible parts of a penetration test, but does not describe them itself in the guide.
How often should a test be repeated?
In the higher-obligations regime at least once every 2 years under Decree 409/2025 Coll., for payment cards at least once every 12 months under PCI DSS. NCSC points out that a test is valid only for the day it was run.
Sources
- NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment, September 2008, section 5.2: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
- NCSC, Penetration testing, published 8 August 2017, reviewed 10 January 2022: https://www.ncsc.gov.uk/guidance/penetration-testing
- PCI SSC, Information Supplement: Penetration Testing Guidance, version 1.1, September 2017, sections 2.1, 4 and 5: https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf
- Decree No. 409/2025 Coll., § 11(3) and § 24(5), effective from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-409
- PCI DSS v4.0, SAQ D for Merchants, April 2022, requirements 11.4.2 and 11.4.3: https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Merchant.pdf
- Lumenax, Penetration tests, viewed 25 October 2026: https://www.lumenax.cz/penetracni-testy
How to prepare for a penetration test: rules, consents and material
Retest after a penetration test: when it is mandatory and what it checks
Black box, grey box, white box: how to choose the type of penetration test
