1 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
What does a penetration tester do? Skills, certifications and how to judge the person testing you
A penetration tester is a security professional who is paid to break into systems with written permission, so the owner can fix what is found before someone else uses it. This guide explains what the job involves day to day, which skills and certifications matter, how people get into the field, and what to look for in the testers a firm sends you.
What a penetration tester is
A penetration tester (also written pentester or pen tester) is a security specialist who simulates real attacks against an organisation's systems, applications, networks and people, within a written scope and with explicit authorisation, and then documents how far an attacker could get and what to change. The authorisation is what separates the work from a crime: in the Netherlands, unauthorised access to a computer system is computervredebreuk under Article 138ab of the Wetboek van Strafrecht, and comparable offences exist in every jurisdiction. The tester's deliverable is not access. It is a report that lets engineers reproduce and close each finding and lets management understand the business impact.
The term is sometimes used interchangeably with ethical hacker. The difference is one of discipline versus title. Ethical hacker describes anyone who applies offensive skills lawfully; penetration tester describes a specific, scoped, time-boxed professional service with a methodology (PTES, OWASP WSTG, NIST SP 800-115) and a report at the end. We cover that distinction in our guide to ethical hackers. This article stays with the profession: what the work is, who does it well, and how you can tell.
Most penetration testers work for specialised firms or in the internal security teams of large organisations. In an external firm, a tester typically runs several engagements a month across very different targets: a customer portal one week, an Active Directory estate the next, a cloud environment or a mobile application after that. That variety is why breadth of skill matters as much as depth, and why the good ones keep learning for their entire career.
What a penetration tester does in a typical engagement
A standard engagement runs one to three weeks. The hands-on attacking is the visible part; the preparation and the writing are where the quality is decided.
1. Scoping and rules of engagement
Before anything is touched, the tester agrees with the client exactly which systems, roles and time windows are in scope, which actions are off limits (no denial of service on production, no social engineering unless scoped), who to call when something critical is found, and obtains the signed authorisation that makes the test lawful.
2. Reconnaissance and mapping
The tester builds a picture of the target: exposed hosts and services, subdomains, technology stack, user roles, APIs, third-party components, credentials that have appeared in public breach data. For internal tests this means mapping the network, domain trusts and privileged accounts. Good reconnaissance decides where the limited days go.
3. Vulnerability discovery
Scanners run first to clear the known issues: missing patches, weak TLS, default credentials. The tester then goes where tools cannot: authorisation logic between user roles, business workflows that can be abused, chains of individually low-severity issues, and misconfigurations that only matter in combination.
4. Exploitation and privilege escalation
With the client's agreement, the tester proves impact by exploiting what was found: reading another tenant's data, moving from a web server into the internal network, escalating from a standard user to domain administrator. Proof is what turns a theoretical finding into a prioritised one.
5. Reporting
Usually a third or more of the engagement. Each finding gets a severity (CVSS v3.1 or v4.0), evidence, reproduction steps, affected assets and a specific fix. An executive summary translates the technical findings into business risk. Compliance mapping (ISO 27001, SOC 2, PCI DSS, DORA, NIS2) is added where the client needs it.
6. Debrief and retest
The tester walks engineers through the findings, answers remediation questions, and later verifies that fixes actually closed the issue. The retest is where many partial fixes are caught: a patched endpoint with the same flaw on a sibling route, a firewall rule that blocks one port but not the service behind it.
The skills a penetration tester needs
No single tester masters all six at the same depth. A good firm staffs each engagement so that the skills match the target.
Web application and API security
The OWASP Top 10 and the OWASP Web Security Testing Guide as a baseline; authentication and session handling; authorisation flaws such as insecure direct object references and privilege escalation across roles; injection; server-side request forgery; business-logic abuse; OAuth and JWT misuse; REST and GraphQL specifics. This is where most externally reachable findings come from.
Network and infrastructure
TCP/IP, routing, segmentation and firewall rules; Windows and Linux internals; the common services (SMB, RDP, SSH, LDAP, Kerberos) and their weaknesses; VPN and remote access; and the craft of turning a foothold on one host into lateral movement across many.
Active Directory and identity
Kerberos abuse (Kerberoasting, delegation), NTLM relay, access-control misconfigurations, Group Policy, Active Directory Certificate Services, and hybrid identity with Entra ID. In most internal tests, the path to domain administrator runs through identity rather than through an unpatched server.
Cloud platforms
IAM policies, storage permissions, metadata services, serverless and container misconfigurations across AWS, Azure and Google Cloud; Kubernetes role-based access control; review of infrastructure-as-code. Cloud findings are rarely exploits in the classic sense. They are mostly permissions that nobody meant to grant.
Scripting and tooling
Python, Bash and PowerShell to automate repetitive checks, adapt public exploit code, parse large outputs and write small proof-of-concept tools. Reading code in C#, Java, JavaScript or Go matters for white-box tests and for the source-review work that OSWE-level web testing requires.
Communication and reporting
Writing a finding an engineer can reproduce in ten minutes, and an executive summary a board can read in five. Running a calm call when a critical issue surfaces on day one. The best testers are ultimately judged by their reports, because the report is what the client keeps after the engagement ends.
Penetration tester certifications and what each one proves
Certifications are a floor, not a ceiling. Hands-on, exam-in-a-lab credentials carry more weight than multiple-choice ones. Our separate guide to penetration testing certifications and accreditations goes deeper; this is the short version.
| Certification | Issuer | Format | What it demonstrates |
|---|---|---|---|
| eJPT (Junior Penetration Tester) | INE Security | Practical, entry level | Fundamentals of network and web testing; a starting point, not a hiring bar |
| OSCP (Offensive Security Certified Professional) | OffSec | 24-hour hands-on exam plus report | Exploitation, privilege escalation and Active Directory basics under time pressure; the common baseline for professional testers |
| OSWE (Offensive Security Web Expert) | OffSec | 48-hour white-box exam | Source-code review and exploit development against web applications |
| OSEP (Offensive Security Experienced Penetration Tester) | OffSec | 48-hour hands-on exam | Advanced Active Directory attacks, lateral movement and evasion in defended environments |
| CRTO (Certified Red Team Operator) | Zero-Point Security | Multi-day lab exam | Adversary tradecraft with a command-and-control framework; red team rather than pentest focus |
| GPEN (GIAC Penetration Tester) | GIAC / SANS | Proctored exam with hands-on components | Methodology and breadth across the testing process; common in US enterprise and government procurement |
| CREST CRT / CCT | CREST | Practical and written exams | Professional registration of UK origin; CCT (Infrastructure or Application) is the senior tier, often required in UK and increasingly in EU tenders |
How to become a penetration tester
There is no single route, but the people who do well share a pattern. They start with foundations: how networks actually move packets, how Linux and Windows manage users, processes and permissions, how a web application handles a request from browser to database, and one scripting language well enough to automate the boring parts. A background in system administration, software development or a SOC analyst role is a common first step, because it builds exactly these foundations against real systems with real consequences.
Then comes deliberate practice in lawful environments: hands-on lab platforms, capture-the-flag competitions and intentionally vulnerable applications. The goal is not to collect flags. It is to build a method: enumerate thoroughly, form a hypothesis, test it, take notes as if someone else will read them. Writing up every lab in report form is the single habit that most separates job-ready candidates from hobbyists, because reporting is half the job and almost nobody practises it voluntarily.
The first certification is usually eJPT or OSCP, and OSCP is the one most firms, including HackersHub, treat as the entry bar. Responsible disclosure and bug bounty programmes offer a lawful way to test real systems, but only on targets that have published a policy inviting it, within the published scope, reported privately. In the Netherlands, the NCSC guideline on Coordinated Vulnerability Disclosure sets out how organisations and researchers should handle that process. From there, specialisation follows the work: web (OSWE), Active Directory and evasion (OSEP), red teaming (CRTO), cloud, mobile, or operational technology.
Penetration tester vs ethical hacker vs red teamer vs security analyst
Four terms that are often mixed up in job titles and in proposals. They describe different work.
| Role | What they do | Typical scope | Output |
|---|---|---|---|
| Penetration tester | Finds and proves as many exploitable weaknesses as possible within a defined scope | Specific applications, networks or environments; days to weeks; defenders usually informed | Report with findings, severity, evidence and fixes; retest |
| Ethical hacker | Umbrella term for anyone applying offensive skills lawfully: pentesters, red teamers, bug bounty hunters, researchers | Varies; defined by whatever authorisation they operate under | Varies: reports, disclosures, research |
| Red teamer | Simulates a specific adversary pursuing an objective, measuring detection and response as much as vulnerabilities | The whole organisation; weeks to months; stealth; most defenders not told | Attack narrative, detection gaps, response timeline |
| Security analyst (SOC, blue team) | Monitors, detects, triages and responds to attacks | Continuous, across the whole estate | Alerts, incident reports, detection rules |
Judging the tester a firm sends you
When you commission a test you are buying the people, not the brand. Our guide to choosing a penetration testing company covers the procurement questions; these are the signals about the individual testers.
- Named testers in the proposal and in the report, with certifications you can verify through the issuer's public verification service
- At least one tester with a senior hands-on credential (OSCP as a minimum; OSWE, OSEP or CREST CCT for complex targets) and demonstrable experience with your specific technology
- A documented methodology (PTES, OWASP WSTG or MASTG, NIST SP 800-115) and an explicit statement that the work is manual, not a rebranded scan
- A redacted sample report, so you can judge whether findings are reproducible and whether the executive summary says something a board can act on
- Professional indemnity insurance, and a signed authorisation and rules-of-engagement document before testing starts
- A clear escalation path: who calls whom, within what time, when a critical finding appears mid-test
- A retest of fixed findings, included or clearly priced, since that is where the value is confirmed
How HackersHub staffs an engagement
Every HackersHub tester holds at least OSCP, and the team includes OSWE and CREST-certified testers for the web and infrastructure work that needs them. Engagements are led by a named senior tester, Michael van Mameren, Lead Penetration Tester (OSCP), or a colleague at the same level, who scopes the work, tests hands-on and signs the report. Our methodology follows PTES, OWASP WSTG and MASTG, and NIST SP 800-115. Every report contains an executive summary, CVSS-scored findings with evidence, an attack narrative and a prioritised remediation plan, and a verification retest of medium and higher findings within 90 days is included.
We are based in Amsterdam, Netherlands, with more than ten years of offensive security work behind us and a rating of 4.9/5 across 127 reviews. If you want to know who will be testing you before you sign, ask. We will tell you, by name.
Frequently asked questions
Related guides
- What is an ethical hacker? Definition, legal basis and how to hire one
- Penetration testing services by HackersHub
- How to choose a penetration testing company
- Penetration testing certifications and accreditations explained
- What is penetration testing? Meaning, phases and methodology
- Red team vs penetration testing: which do you need?
- Penetration testing tools: what professionals actually use
Want to know who will be testing you?
Every HackersHub engagement is scoped and led by a named, OSCP-certified senior tester, with a methodology you can read and a report you can act on. Talk to an expert about your scope.