Penetration test (pentest)
An authorized, time-boxed attack on your app by security testers, ending in a report of what they could break and how badly.
The scope, accounts and allowed techniques are agreed in writing first. Testers combine tools with manual work on logic, authorization and data access, which scanners miss. The report rates each finding by severity; a retest confirms the fixes. Enterprise buyers and assessments such as CASA often ask for a recent one, usually from within the last year.
Related terms
- OWASP ASVS (Application Security Verification Standard): An open checklist of security requirements for web apps and APIs, in three levels, used for design, testing and assessments such as CASA.
- CASA (Cloud Application Security Assessment): The security assessment based on OWASP ASVS that Google requires for apps using restricted scopes, such as Gmail data.
- Vulnerability disclosure program (VDP): A public policy that tells security researchers how to report a flaw, what is in scope and that they will not be sued for reporting in good faith.
