What Is Penetration Testing and Does Your Business Need It?

What a penetration test actually is

A penetration test is an authorised, controlled attack on your own systems. A tester uses the same tools and techniques a real attacker would (probing your website, network, and applications), but instead of stealing data, they document every way in and hand you the map. It's the difference between waiting to be robbed and hiring someone to test your locks.

It's different from an automated scan. A scanner flags known issues; a human tester chains small weaknesses together the way a real attacker does, and finds the things scanners miss.

That chaining is the whole value. A scanner reports three findings as three separate low-severity items. A tester notices that the first one leaks a username, the second one lets you guess passwords without limit, and the third one means a normal user can reach an admin page. Individually, minor. Together, a way in. No scanner will tell you that, because it does not reason about your business.

How to spot a scan being sold as a test

This is worth knowing before you spend anything, because the market rewards the pretence. An automated scan takes minutes and costs almost nothing to run, so a $200 "pentest" is usually a scanner report with a cover page. The tells:

• It arrives too fast. A genuine test of a business website takes days. A report the same afternoon is a tool's output, not a person's.
• The findings have no proof. A real finding shows what was done and what came back. "Possible SQL injection detected" with no demonstration usually means nobody checked whether it was real.
• Nothing is ranked by your business. Scanner severity is generic. A tester should tell you which finding matters most for your site, and they cannot do that without understanding what your site does.
• There are no false positives removed. Raw scanner output is full of things that are not actually exploitable. Filtering those out is a large part of the work you are paying for.
• Nobody asked you anything. A tester who never asked what your site does, who uses it, or what would hurt most if it leaked has not scoped anything.

None of this makes automated scanning worthless. It is a useful first pass, and ours is free for exactly that reason. The problem is only ever the pricing of one as the other.

Who actually needs one

If your business handles money or sensitive data, the answer is almost certainly yes. In particular:

• Banks & financial services: regulatory pressure and high-value targets.
• Travel agents: they hold passports, payment details, and itineraries.
• Legal firms: confidential client data is the whole business.
• Casinos & gaming: cash-heavy, compliance-bound, and heavily targeted.
• Healthcare: patient records are among the most sensitive data there is.

If a breach would cost you customers, money, or your reputation, a pentest is cheaper than finding out the hard way. There is also a compliance angle since the Data Protection Act 2021 came into force: being able to show you assessed your security and acted on the findings is a materially stronger position than having nothing to point at.

The two kinds of test, and which you want

The main choice is how much you tell the tester before they start.

• Unauthenticated, from the outside. The tester gets your domain and nothing else, and works the way a stranger would. This tells you what is reachable by anyone on the internet. It is the right starting point for a brochure site or a business that mainly worries about the front door.
• Authenticated, with a login. You provide test accounts, so the tester can examine what a logged-in customer or staff member could reach. This is where the expensive findings usually live, because most real damage happens after someone is inside. If your site has accounts, bookings, payments or a dashboard, you want this.

Testing only the outside of a site with logins tells you about a fraction of it. If a quote does not say which kind it is, ask, because the difference in effort is substantial and so is the difference in what you learn.

What you have to provide

Less than most people expect, but not nothing. A test needs:

• Written authorisation. Testing systems without permission is a crime. This is not a formality.
• A clear scope. Which domains, which applications, which servers. Written down before anything starts.
• Test accounts, if you want the authenticated testing above.
• A contact who can answer quickly. If something critical turns up on day two, you want to hear about it on day two.
• Your host in the loop, if you are on shared hosting. Some providers treat testing traffic as an attack and block it, which wastes everyone's time.

What a pentest report looks like

A good report is written for humans, not just engineers. Ours includes:

• An executive summary: the overall risk picture in plain language for decision-makers.
• Each finding rated by severity (Critical, High, Medium, Low) so you know what to fix first.
• Proof: exactly how the issue was exploited, with evidence.
• Clear remediation steps: what to change, in language your developer can act on immediately.

You should finish reading a pentest report knowing precisely what's wrong, how serious each problem is, and what it takes to fix it. If a report leaves you more confused than when you started, it wasn't done right.

What a test does not cover

Worth saying plainly, because vendors rarely do. A penetration test is a snapshot of a defined scope on a particular week. It does not tell you about a weakness introduced by next month's update, it does not cover systems you left out of scope, and unless you asked for it, it does not test your staff against phishing, which is a separate exercise with its own rules.

It also does not fix anything by itself. The report is the deliverable. The fixing is either your developer's job or ours, and you should decide which before you commission the work rather than after.

How often

Annually is the usual baseline for a site that is not changing much. Beyond that, the trigger is change rather than the calendar: before a public launch, after adding payments or logins, after a rebuild, or after switching developers. A test on a site that has been rewritten since the last one is effectively a first test.

How long it takes and what it costs

For a typical Zimbabwe business web application, testing takes one to two weeks, and the written report follows within 3 working days of testing ending. We tell you about any critical finding the same day we find it. You don't have to wait for the final document to start protecting yourself.

Our penetration testing service starts at $1,200, and that page sets out the scope and the deliverables in full. If you want a sense of your exposure before committing to anything, run our free website security check first. It is passive, it takes seconds, and it will not touch your live site. It will not find what a manual test finds, and we would rather say so than pretend otherwise.