Newtec Services · Penetration Testing 101
Your security tools say you’re protected. The only way to know for certain is to let a professional try to break in, on your terms, before someone else does it on theirs.
Most organisations believe their controls are working: the firewall is configured, endpoint protection is installed, multi-factor authentication is switched on. Penetration testing challenges that assumption by having qualified security professionals attempt to breach those controls using the same techniques real attackers use, and the results are frequently different from what the organisation expected.
What Is Penetration Testing, Really?
It’s an authorised, controlled attack on your own systems, applications, and people, carried out by professionals so you find the weaknesses first. It’s different from a vulnerability scan: a scan typically compares your systems against a list of known weaknesses, while a penetration test adds human judgement, chaining small, individually low-risk findings together to show a real path to sensitive data.
Why This Should Matter at Leadership Level
Neither GDPR nor NIS2 mentions penetration testing by name, but both require you to check that your security actually works. GDPR Article 32 requires a process for regularly testing and evaluating the effectiveness of your security measures, and NIS2 Article 21 requires in-scope organisations to have policies and procedures to assess the effectiveness of their cybersecurity measures. A penetration test is one of the most direct ways to produce that evidence, and to find the gaps before a regulator, an auditor, or an attacker does.
What Gets Tested
- Network: external and internal infrastructure, including misconfigured services, weak access controls, and unpatched systems.
- Web applications: customer-facing or internal applications, for weaknesses such as injection flaws, broken authentication, and access-control gaps.
- Wireless: encryption weaknesses, rogue access points, and credential interception risks.
- Social engineering: how your people respond to a convincing phishing email, phone call, or impersonated request.
- Active Directory and identity: overprivileged accounts, stale credentials, and misconfigurations that let an attacker escalate privileges or move laterally.
What You Get at the End
A written report covering each vulnerability found, its severity, how it was exploited, the potential business impact, and a prioritised fix, written so leadership can read it, not just the engineer. A debrief session is provided where appropriate, and retesting can confirm that fixes have actually worked.
Quick Answers (Penetration Testing FAQ)
Q: We already run vulnerability scans. Isn’t that enough?
Scans are valuable and belong in any security programme, but they typically check against known weaknesses. They won’t chain findings into a real attack path, test whether staff would fall for a convincing impersonation, or show the business impact of a flaw.
Q: Do GDPR or NIS2 require a penetration test?
Not by name. Both require you to test and assess whether your security measures are effective; a penetration test is a recognised way to evidence that, with frequency and scope depending on your risk.
Book a cyber security assessment. Talk to us about a penetration test scoped to your environment:
Further Reading (Primary Sources)
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment. The US federal guide to planning and conducting security tests, including penetration testing (2008).
- GDPR (EU) 2016/679. Article 32(1)(d) sets the process for regularly testing and evaluating security measures.
- NIS2 Directive (EU) 2022/2555. Article 21(2)(f) covers assessing the effectiveness of cybersecurity risk-management measures.
- NCSC Ireland: NIS2 Quick Reference Guide. Ireland’s official summary of NIS2 obligations.
