Penetration test
A penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would. Cyber Essentials does not require one, and Cyber Essentials Plus is not a penetration test. Plus runs five defined test cases aimed at an opportunist attacker using low-skill methods.
- Term
- Penetration test
- Also known as
- Pen test, Pentest, Ethical hacking
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- A2.4
- Reviewed against
- Requirements v3.3
What does the term penetration test mean in Cyber Essentials?
A penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.
How does penetration test apply to Cyber Essentials?
In plain terms
It is hiring a professional burglar to try your doors and windows, with your written permission, and then tell you exactly how they got in. A good tester thinks creatively, chains small weaknesses together and tries things no checklist covers. A test is scoped to a target, such as a website, a network or a cloud tenant, and usually takes days.
What Cyber Essentials asks
Neither level of Cyber Essentials asks for a penetration test. Cyber Essentials Plus is a technical audit that follows the NCSC's Cyber Essentials Plus test specification v3.2. It has five test cases: an external vulnerability scan, an authenticated patch scan of sampled devices, malware protection tests, a check of MFA on cloud services and a check of account separation. Each has a fixed pass or fail rule. Test case 1 states its purpose as "To test whether an Internet-based opportunist attacker can hack into the Applicant's system with typical low-skill methods." The assessor reviews what the scans find but does not attempt to exploit it.
For bespoke web applications, which are out of scope, the requirements point to development and testing "in line with commercial best practice".
The question set also keeps penetration testing environments out of the assessment. The Danzell scope guidance says "Development, testing, and penetration testing (pentesting) networks should not be included in the scope" and that "These networks must be kept separate from the rest of your IT systems using a firewall or VLAN." A2.4 repeats that "Development/testing and pen-testing networks must not be included."
See Cyber Essentials Plus and test 1: external vulnerability scan. Related: vulnerability scan, Cyber Essentials Plus.
Related terms
- Vulnerability scanA vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses.
- Cyber Essentials PlusCyber Essentials Plus is the higher level of Cyber Essentials, where an assessor independently tests your systems instead of relying only on your written answers.
- PhishingPhishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.
- RansomwareRansomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.
- SaaS (Software as a Service)Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.
- SandboxingSandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data.
Frequently asked questions
A penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.
In the 2026 Danzell question set, penetration test comes up at A2.4. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.