What is penetration testing, and when does an institution need it?
A plain-language explanation of penetration testing — what testers actually do, how it differs from a vulnerability scan, and the moments when it is worth the investment.
A penetration test is an authorised, simulated attack on your systems by security professionals. The goal is not to prove that you can be hacked — almost everyone can — but to find the specific weaknesses an attacker would use, show their real impact, and give you a prioritised plan to fix them.
How it differs from a vulnerability scan
A scan is automated: a tool checks software versions and known issues and produces a long list. A penetration test is human-led: testers chain weaknesses together, test business logic ("can a student change another student's marks?"), and verify which findings actually matter. Scans are cheap and should run monthly; tests are deeper and run at key moments.
When it is worth it
- Before go-live of any system that holds personal data or handles money — an examination platform, fee portal, placement system.
- After major changes — new authentication, a new integration, a move to the cloud.
- For compliance or due diligence — accreditation, insurance, or a partner's security questionnaire.
- After an incident, to confirm the fix and look for what else was missed.
What a good test includes
- A written scope and rules of engagement — what is tested, when, and how to stop.
- Testing across the OWASP categories plus your application's specific logic.
- A report that ranks findings by real risk, with reproduction steps and clear remediation.
- A re-test after fixes, so you can show the issues are closed.
What to ask a provider
Ask who will do the work and their experience, how findings are protected, and whether re-testing is included. Avoid providers who only send automated scan output with a new cover page.