Penetration testing, vulnerability assessment, VAPT, red team, bug bounty and PTaaS
These terms overlap in sales material but describe different services. A vulnerability assessment finds and ranks known weaknesses, usually with scanners. A penetration test goes further: testers exploit weaknesses inside an agreed scope to prove what an attacker could reach.
The other labels describe how the testing is packaged or how far it goes.
| Service | What it is | Main output | Best used for |
|---|---|---|---|
| Vulnerability assessment | Automated and manual identification of known weaknesses across systems | A prioritised list of possible issues | Routine checks between penetration tests |
| Penetration test | An authorised, scoped attack that exploits weaknesses | Proven findings with proof of concept and fix advice | Yearly assurance, compliance evidence and pre-release checks |
| VAPT | A combined service: vulnerability assessment plus penetration testing | Scan results and validated exploitation in one report | Buyers who want broad coverage and proof in one engagement |
| Red team | A goal-driven campaign that imitates a real adversary over weeks and tests people, process and technology | An attack narrative with detection and response observations | Mature security teams |
| Purple team | Red and blue teams work together so defenders tune detection while attacks run | Improved detection rules and playbooks | Teams that have run a red team and want to act on it |
| Bug bounty | A programme that pays outside researchers for valid reports | Reports from many researchers over time | Mature application teams that need continuous coverage |
| PTaaS | Testing delivered through a platform, with on-demand or continuous testers | A findings dashboard and retests | Teams that release often |
The three main types of penetration testing: black, grey and white box
The three main types are defined by what the tester knows before the test starts. The more the tester knows, the less time goes into discovery and the more time goes into depth.
| Black box | Grey box | White box | |
|---|---|---|---|
| Tester knowledge | None beyond the target name or address | Partial: a user account, an API definition or a network diagram | Full: architecture, credentials and source code |
| Point of view | An outside attacker | A user, partner or attacker who has gained a foothold | A tester working with the engineering team |
| Speed | Slower, because discovery takes time | Balanced | Fastest to reach deep issues |
| Depth | Finds what is visible from outside | Finds authorisation and business-logic flaws | Finds flaws that are hard to see from outside, including code-level issues |
| Typical use | External network tests and red team starts | Web, API and mobile tests, and most compliance tests | Pre-release reviews of critical code and architecture |
Most application tests run as grey box, because a logged-in tester reaches the functions where authorisation errors live. Black box suits questions about what an outsider can see. White box suits teams that want the deepest review and can share source code.
Types of penetration testing by target
Providers also sell tests by target. Each target brings its own methods, tools and report content, so scope the test to the system that matters most.
Web application testing
Testers examine login, sessions, input handling and business logic against the OWASP Top 10 and the OWASP Web Security Testing Guide. Choose it before a release, after major changes and for systems in PCI DSS scope.
API testing
Testers check authentication, authorisation and data exposure in REST and GraphQL interfaces. Choose it when mobile apps, partners or microservices depend on your APIs, because API flaws often bypass the web front end.
Mobile application testing
Testers review the app on iOS and Android: local storage, communication with the back end, and protections such as certificate pinning. Choose it before publishing to app stores and after major releases.
Cloud testing
Testers review cloud accounts, identity and access settings, storage exposure and network paths. Choose it when production runs on a public cloud, and check the cloud provider's own testing rules first.
Internal network testing
Testers start inside the network, as an employee, a visitor or malware would. They test segmentation, Active Directory and privilege escalation. Choose it to measure the impact of a phishing or insider compromise.
External network testing
Testers target internet-facing hosts, services and exposed credentials from outside. Choose it every year and whenever the attack surface changes, such as new cloud assets or remote access.
Wireless testing
Testers assess Wi-Fi encryption, rogue access points and guest network separation, usually onsite. Choose it for offices, branches and retail sites where a nearby attacker could join the network.
IoT and OT testing
Testers examine connected devices, firmware and industrial control systems with safety limits that protect running equipment. Choose it for factories, utilities, buildings and device makers.
Social engineering testing
Testers send phishing emails or make calls to measure how staff respond to deception. Choose it to find which teams need training and whether reporting and email controls work.
Physical security testing
Testers try to enter premises, reach network ports or plant devices, within strict rules of engagement. Choose it for data centres, offices and sites where physical access leads to digital access.
Red team operations
Testers pursue defined goals, such as reaching a database, across people, process and technology while the security team defends. Choose it when basic testing is routine and you want to test detection and response.
Which type of penetration test do you need?
Match the test to the question you are asking. The table pairs common situations with the tests that answer them.
| Your situation | Test to plan | Why |
|---|---|---|
| Launching a customer portal or mobile app | Grey box web application, API and mobile tests | A logged-in view reaches the functions where authorisation errors sit |
| Preparing for a PCI DSS assessment | Internal and external network tests, application tests and segmentation tests | Requirement 11.4 asks for internal and external testing, and for segmentation testing where segmentation is used |
| Moving workloads to the cloud | Cloud configuration test and an external network test | Identity settings and exposed storage are the usual entry points |
| Checking whether your security team detects attacks | Red team or purple team exercise | These tests measure detection and response, not only technical controls |
| Buying or merging with another company | External and internal network tests | They show the real state of the network you inherit |
| Running factories, utilities or smart buildings | IoT and OT testing with strict safety limits | Running equipment needs methods that avoid disruption |
When two rows apply, combine them in one engagement with a single scope and report. See the cost guide for how scope units drive the price.
The 5 stages of a penetration test
Every penetration test follows five stages, whatever the target. The stages below are the ones used across this site; the mapping table that follows shows how they line up with PTES, NIST SP 800-115 and the five-phase ethical hacking model. Step through them to see what testers do, what you receive and what to ask.
1. Scoping and rules of engagement
The provider and the buyer agree the assets in scope, the exclusions, the test window, the depth of testing, the emergency contacts and the safety limits. They sign an authorisation letter, because testing without permission is an offence under UAE cybercrime law. Good scoping also fixes how findings are rated and who receives the report, which prevents disputes later. Changes after this point go through the named contact.
- You receive
- a signed scope, an authorisation letter and an emergency contact list.
- Ask the provider
- "What happens if testers find a system outside the agreed scope?"
2. Reconnaissance and enumeration
Testers build a map of the attack surface. They collect public information, list domains, subdomains, services, technologies and accounts, and probe in-scope systems to see what responds. The aim is a complete list of entry points, ranked by how promising they look. Reconnaissance combines tools with manual analysis, and the manual part is where most of the value comes from.
- You receive
- an asset inventory and a list of entry points.
- Ask the provider
- "Which assets did you find that we had not listed?"
3. Vulnerability analysis and exploitation
Testers analyse entry points for weaknesses, then try to exploit them to confirm they are real, following methods such as the OWASP Web Security Testing Guide. They record the steps and the evidence for each confirmed finding. Exploitation is what separates a penetration test from a scan, because a scan only reports that a weakness may exist.
- You receive
- reproducible proof of concept for each confirmed finding.
- Ask the provider
- "How do you separate confirmed findings from scanner output?"
4. Post-exploitation and impact
Testers show what an attacker could do after a first success: escalate privileges, move to other systems and reach sensitive data. This stage turns a technical flaw into a business risk and shows which weaknesses chain together. Testers work inside the safety limits from stage 1 and clean up accounts, files and tools they created.
- You receive
- an attack-chain narrative and a list of systems and data reached.
- Ask the provider
- "What safeguards protect production systems during this stage?"
5. Reporting and retest
The provider writes the report, rates each finding, explains how to fix it and presents the results to technical and executive readers. Your team fixes the issues, and the provider retests to confirm. The report and the retest result are the evidence that auditors and customers ask to see.
- You receive
- an executive summary, a technical report, a remediation plan and a retest result.
- Ask the provider
- "Can I see a sample report, and how many retest rounds are included?"
The same work appears under different names in the main published methodologies.
| Stage on this site | PTES (7 phases) | NIST SP 800-115 (4 phases) | Five phases of ethical hacking |
|---|---|---|---|
| 1. Scoping and rules of engagement | Pre-engagement interactions | Planning | |
| 2. Reconnaissance and enumeration | Intelligence gathering, threat modeling | Discovery | Reconnaissance, scanning |
| 3. Vulnerability analysis and exploitation | Vulnerability analysis, exploitation | Attack | Gaining access |
| 4. Post-exploitation and impact | Post exploitation | Attack | Maintaining access, clearing tracks |
| 5. Reporting and retest | Reporting | Reporting |
The Penetration Testing Execution Standard names seven phases, and NIST SP 800-115 describes penetration testing in four: planning, discovery, attack and reporting. The five-phase model, published by EC-Council, names reconnaissance, scanning, gaining access, maintaining access and clearing tracks. The mapping is approximate, because each model draws its boundaries differently.
What penetration tests typically find
Findings fall into recurring classes. Knowing them helps you read a report and judge whether a test covered the right ground. Each class is described by weakness type, not by a ranking of risk.
| Finding class | Example | Where it appears |
|---|---|---|
| Broken access control | A user changes an identifier in a request and sees another user's data, known as IDOR | Web applications and APIs |
| Injection | SQL injection or cross-site scripting through unvalidated input | Web applications, APIs and mobile back ends |
| Weak authentication | Guessable passwords, missing multi-factor authentication or reusable session tokens | Applications, VPNs and remote access |
| Misconfiguration | Open storage, default credentials or services exposed to the internet | Cloud, networks and servers |
| Outdated components | Software with published vulnerabilities, identified by CVE numbers | Servers, libraries and devices |
| Weak segmentation | A foothold in one zone reaches sensitive systems in another | Internal networks and OT |
| Exposed secrets | Keys, tokens and passwords in code, logs or public repositories | Source code and cloud environments |
Reports usually cite CWE identifiers for the weakness class and CVSS ratings for severity, so engineers can look up the cause and prioritise the fix.
Tools penetration testers use
Testers use tools for speed and coverage, but a tool list is not a methodology. Two providers can own the same tools and deliver very different results, because the results depend on how testers choose, chain and interpret them. The table describes tools that appear often in test reports and proposals; it is not a ranking.
| Tool | What it is for | Typical stage |
|---|---|---|
| Burp Suite (PortSwigger) | Intercepting and modifying web traffic to test web applications and APIs | Stages 2 and 3 |
| Nmap | Network discovery and port and service scanning | Stage 2 |
| Metasploit (Rapid7) | A framework of exploit modules and payloads for validating weaknesses | Stages 3 and 4 |
| ZAP (formerly OWASP ZAP) | An open-source web proxy and scanner for finding web application issues | Stages 2 and 3 |
| BloodHound (SpecterOps) | Mapping Active Directory relationships to find paths to privileged accounts | Stages 2 and 4 |
| Nessus (Tenable) and similar scanners | Vulnerability scanning of hosts and services against known weakness databases | Stage 2 |
Adversary behaviour is documented in the MITRE ATT&CK knowledge base, which red teams use to plan realistic campaigns. Ask any provider how it validates scanner output by hand.
Are penetration testers hackers, and is pentesting legal?
Ethics in the profession rest on three habits: staying inside the scope, reporting findings privately to the system owner and protecting any data seen during the test. Providers sign an NDA before work starts. The compliance guide lists the documents that make a test lawful.
Can you penetration test your own website?
Free tools such as ZAP and Nmap let you find common issues on your own systems. A self-test cannot replace a professional test in three cases:
- Compliance. Frameworks such as PCI DSS Requirement 11.4 expect testing by qualified people and a formal report.
- Fresh eyes. Builders tend to test what they expect to break, and outside testers find different issues.
- Depth. Chained exploits, authorisation flaws and business-logic issues need experienced testers.
When you commission a test, the guide to choosing a provider explains what to ask.
Frequently asked questions about types of penetration testing
What are the main three types of penetration testing?
The three main types are black box, grey box and white box testing. They differ in what the tester knows in advance: nothing beyond the target, partial access such as a user account, or full access to architecture and source code. Tests are also grouped by target, for example web application, API, mobile, cloud and network, and red teaming is sold separately because it tests people and processes as well as systems.
What are the 5 stages of penetration testing?
The five stages are scoping and rules of engagement, reconnaissance and enumeration, vulnerability analysis and exploitation, post-exploitation and impact, and reporting and retest. Published methods group the work differently: PTES has seven phases, NIST SP 800-115 has four, and the ethical hacking model taught by EC-Council has five. The stages above map to all three, and a good provider can show its own methodology.
What is another name for penetration testing?
Penetration testing is also called pen testing, pentesting, ethical hacking and security testing. Providers often sell it as VAPT, short for vulnerability assessment and penetration testing. Red teaming is a related but broader exercise that imitates a determined attacker over a longer period, and it tests detection and response as well as technical controls. Read the service description, because labels vary between providers.
Is VAPT the same as a penetration test?
Not exactly. VAPT combines a vulnerability assessment, which lists weaknesses, with a penetration test, which exploits them to prove impact. Some providers use the label for a scan with a short report, so check the method. Ask what is tested by hand, how findings are validated and whether the report includes proof of concept. A full penetration test always includes manual exploitation.
What are the top 5 penetration testing tools?
There is no official ranking of tools. Tools that appear often in test reports are Burp Suite for web applications, Nmap for network discovery, Metasploit for exploitation, ZAP for web scanning and BloodHound for Active Directory. A tool list does not show quality, because results depend on the tester's method and judgement. Ask a provider how it validates automated output by hand.
What is the best software for penetration testing?
No single program is best, because each target needs different tools. Web applications call for an intercepting proxy such as Burp Suite or ZAP, networks for a scanner such as Nmap, and Active Directory for a graph tool such as BloodHound. Choose the provider by method, credentials and sample report, not by the software it lists. Skilled testers swap tools to suit the target.
How do I pentest my own website?
Define the scope in writing, test a staging copy where possible, and check your hosting provider's testing rules. Map the site, scan it with a tool such as ZAP, and review login, session, input and access control against the OWASP Web Security Testing Guide. Record findings and fix them. For compliance, such as PCI DSS Requirement 11.4, commission a qualified provider.
Sources and updates
Methodology names on this page come from the published standards below, read in November 2026. Tool descriptions summarise what each tool is for and are not rankings.
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
- OWASP Web Security Testing Guide
- Penetration Testing Execution Standard
- MITRE ATT&CK
- EC-Council: the 5 phases of ethical hacking
- CREST marketplace
Related guides: AI penetration testing and how much a penetration test costs in the UAE. CREST accreditation of a provider can be checked on the CREST marketplace.
Last updated