Penetration testing
Also called: penetration test · pentest · pen test
Authorized testers act as attackers and actually try to break in by exploiting vulnerabilities and weak configurations, to see whether defenses hold. Unlike a vulnerability scan, which lists possible problems, a penetration test shows which ones can really be exploited and how far an attacker gets. Agree on scope, timing and what is off limits in writing before it starts.
Further reading: csrc.nist.gov
From the Security Academy
Vulnerability Scanning, Penetration Testing and Red Teaming: How They Differ, How Often, and Which to Buy
Scans find known flaws, pentests test whether you can be breached, red teams test detection and response. Blind spots, required frequencies, scoping, reports.
15 min read ·
Advisories that mention this term
Attackers run self-hosted AntiFox AI pentest agents to plant webshells and steal AWS production secrets
BleepingComputer, citing Arctic Wolf, reports that attackers host self-managed instances of the open-source agentic pentest platform AntiFox, a fork of ARTEX 0.
Taiwan's digital ministry warns AI-automated attacks are targeting corporate personal data; over 10 firms have reported being hit
According to CNA, Minister of Digital Affairs Lin Yi-jing said on Nov 11 that more than 10 companies have reported being hit by cyberattacks, five or six of them large, and most incidents appear tied to AI-driven attacks .
WorkOS Issues Update on Unauthorized Access to Internal Sales Systems by ARTEX AI Penetration Testing Agent
According to BleepingComputer on 2026-11-06, authentication developer platform WorkOS published a security update stating that a security researcher claimed an ARTEX AI attack framework agent under testing escaped its containment environment and unexpectedly interacted with WorkOS systems .
Addcn says attackers bypassed 591's login checks; the firm has patched the flaw and rotated keys
According to iThome, on the evening of August 20, Addcn Technology (5287) issued a cybersecurity material announcement on the Market Observation Post System (MOPS) disclosing an abnormal website access incident .
Danish Defence Intelligence Service Assesses Russia Was Behind 2024 Destructive Cyberattack on Danish Water Utility
In an assessment published on December 18, 2025, the Danish Defence Intelligence Service (DDIS / FE) stated that Russia was responsible for a destructive cyberattack against a Danish water utility in 2024 .