Penetration testing is one of the most sought-after security careers, and the only thing that separates it from computer crime is written authorisation, which is why ethics and legal discipline matter as much as technical skill. This guide covers what penetration testers do day to day, the skills employers test, routes in, the certifications that help (described from the certifying bodies' own pages), how careers progress, and the legal and ethical rules that every tester must work within. It is written for people aiming at their first testing role, developers and administrators considering a move, and managers who hire testers. It deliberately contains no testing techniques; the linked technical guides cover methodology.
Key takeaways
- Authorisation comes first, always. In the UK, accessing a computer when you know the access is unauthorised is an offence under section 1 of the Computer Misuse Act 1990; a signed scope and rules of engagement are what make testing lawful.
- The report is the product. Clients pay for clear findings, risk ratings and fixes they can act on, not for a list of compromised hosts.
- Fundamentals outlast tools. Networking, operating systems, web protocols, Active Directory, cloud identity and scripting are what interviewers probe.
- Certifications signal different things. Practical exams with reports, multiple-choice knowledge exams and UK scheme credentials such as CREST each open different doors.
- Practise only on systems you own or are invited to test. Labs, deliberately vulnerable machines, capture-the-flag events and bug bounty programmes with published rules give legal experience.
What the role does
NIST's NICE Framework (SP 800-181 Rev. 1, v2.0.0) places this work in the Vulnerability Analysis work role, with task T1091 "Perform authorized penetration testing on enterprise network assets", alongside T1118 identify vulnerabilities, T1119 recommend vulnerability remediation strategies and T1279 prepare audit reports. The word "authorized" is in the task statement for a reason.
The UK NCSC describes penetration testing as a way of gaining assurance in an organisation's vulnerability management, not the primary way to find vulnerabilities, and compares it to a financial audit. It also says the client keeps responsibility: "risk assessment and decisions on the application of fixes are your responsibility". A good tester writes for that reader.
| Engagement type | What the tester delivers | Skills emphasised |
|---|---|---|
| Infrastructure (internal and external) | Findings on exposed services, misconfigurations, Active Directory weaknesses | Networking, Windows and Linux, directory services |
| Web application and API | Findings mapped to application risks, with reproduction steps for developers | HTTP, authentication and session handling, code reading. See the API Penetration Testing Guide |
| Cloud | Identity and configuration weaknesses in a cloud tenant | Cloud IAM, audit logs, infrastructure as code. See the Cloud Penetration Testing Guide |
| Mobile, wireless, OT | Specialist findings with strict safety limits in OT | Platform-specific knowledge; OT needs safety awareness. See the OT Penetration Testing Guide |
| Social engineering and physical | Findings on people and process controls | Careful scoping, legal and HR sign-off. See the Social Engineering and Physical Penetration Testing Guide |
| Red team and threat-led testing | Objective-based exercises against detection and response | Senior testers, stealth, operational security. See the Red Teaming Guide |
A typical week at a consultancy: a scoping call, four or five days of testing, a day of report writing, a debrief with the client and perhaps a retest of earlier fixes. In-house testers spend more time retesting, advising developers and running continuous testing programmes. See the Penetration Testing Guide for how engagements run.
Ethics and legal authorisation
This is the part of the job that ends careers when ignored.
- The law: under section 1 of the UK Computer Misuse Act 1990 a person commits an offence if they cause a computer to perform a function intending to secure access to a program or data, the access is unauthorised, and they know it is; the maximum on indictment is two years' imprisonment, a fine or both. Section 3A also makes it an offence to make, adapt, supply or obtain articles, including programs, for use in such offences. Other jurisdictions have equivalents, such as the US Computer Fraud and Abuse Act. Good intentions are not a defence.
- Authorisation must come from someone entitled to give it: the system owner, in writing. A contact at the client cannot authorise testing of a third-party host, cloud provider or SaaS platform they do not control; check the provider's own testing policy.
- Rules of engagement: named targets and IP ranges, dates and times, excluded systems, permitted test types, emergency contacts, a stop procedure, and how data found during testing is handled and destroyed.
- Stay in scope: if you find a path to an out-of-scope system, stop and ask. If you find evidence of a real compromise or illegal content, follow the agreed escalation route.
- Protect client data: credentials, personal data and screenshots in your notes and report are sensitive. Encrypt them, minimise them and delete them as agreed.
- Bug bounty and disclosure: only test programmes with published rules and stay within them. See the Bug Bounty and Vulnerability Disclosure Guide.
The Penetration Test Scoping Checklist sets out what a written scope should contain.
Core skills and tools
| Skill area | What good looks like | How to build it legally |
|---|---|---|
| Networking | TCP/IP, routing, DNS, TLS; recognise common services and ports (22, 25, 53, 80, 88, 389, 443, 445, 3389) and what should be exposed | Build and break your own lab network |
| Operating systems | Windows and Linux permissions, services, scheduled tasks, patching | Administer servers in a home lab |
| Active Directory and identity | Kerberos and NTLM concepts, groups, delegation, service accounts, Entra ID and OAuth | Build a small lab domain and a free cloud tenant |
| Web and APIs | HTTP, sessions, authentication flows, common vulnerability classes in the OWASP Top 10 | Deliberately vulnerable training applications |
| Scripting | Python, Bash or PowerShell to automate repetitive work and parse output | Automate parts of your own lab work |
| Tool literacy | Understand what scanners, proxies and frameworks (for example Nmap, Burp Suite, Metasploit) do and their side effects on production | Use them only in labs and authorised engagements |
| Reporting | Executive summary, risk-rated findings, evidence, reproduction steps and practical fixes | Write a full report for every lab you complete |
| Communication | Explain a finding to a developer and an executive without exaggeration | Present write-ups to peers or local meetups |
Reporting conventions: NCSC guidance asks that reports rate findings HIGH, MEDIUM, LOW or INFORMATIONAL, with CVSS scores alongside rather than instead, and include a way to resolve each issue. Learn to rate honestly; overstated severity damages trust.
Routes into the role
| Starting point | Advantage | Gap to close |
|---|---|---|
| System or network administration | Knows how real estates are built and misconfigured | Attacker mindset, web testing, report writing |
| Software development | Reads code, understands application logic | Infrastructure, Active Directory, networking |
| SOC or incident response | Knows what defenders see | Exploitation concepts, client-facing reporting. See the SOC Analyst Career Guide |
| Graduate or apprenticeship scheme | Structured training, often at a consultancy | Hands-on depth beyond coursework |
| Bug bounty hunter | Proven findings on real targets within published rules | Formal methodology, scoping, full reports |
Many testers start in an adjacent role and move after 1 to 3 years. Consultancies often hire juniors into structured programmes; in-house teams usually want some experience first. The US Bureau of Labor Statistics does not publish a separate penetration tester category; its information security analyst occupation includes checking "for vulnerabilities in computer and network systems" and lists a bachelor's degree as typical entry education. For the wider landscape see the Cybersecurity Careers Guide.
A 12-month plan
- Months 1 to 3: fundamentals. Networking, Linux and Windows administration, and one scripting language. Build an isolated lab you can reset from snapshots.
- Months 3 to 6: structured practice on legal training platforms and deliberately vulnerable machines; write a full report for each.
- Months 5 to 8: one entry or intermediate certification that matches the job adverts you want, chosen from the table below.
- Months 6 to 10: add Active Directory and a cloud tenant to the lab; join capture-the-flag events and, if you choose, bug bounty programmes within their rules.
- Months 9 to 12: assemble a portfolio of three to five sanitised reports or write-ups and apply. In interviews, expect to explain a finding, its risk and its fix.
Certifications that help
Details are from the certifying bodies' pages, checked 24 October 2026. Exams and prices change; confirm before booking. The table is descriptive, not a ranking.
| Body | Certification | Format (as published) | Signals |
|---|---|---|---|
| CREST | CPSA, then CRT (Registered Penetration Tester) | CRT: practical exam with multiple choice, flags and short answers, 2.5 hours plus 15 minutes reading time, Kali Linux provided; valid CPSA required first | UK and CREST member consultancies; CREST states CRT is recognised by the NCSC for its CHECK scheme |
| CREST | CCT INF, CCT APP; CCRTS and CCRTM for red teaming | See CREST for current syllabus | Senior tester and team leader roles |
| OffSec | OSCP and OSCP+ | 23 hours 45 minutes hands-on exam, documentation due within 24 hours; three standalone machines and an Active Directory set, 70 of 100 points to pass; AI chatbots prohibited. OSCP+ expires after three years; OSCP does not | Hands-on ability plus reporting. See the OSCP Certification Guide |
| GIAC | GPEN Penetration Tester | 82 questions, 3 hours, 73% pass for versions from 12 July 2025; covers planning, scoping, exploitation, post-exploitation, Azure and password attacks | Employers using SANS training; US government frameworks |
| EC-Council | CEH, optional CEH Practical | Exam 312-50: 125 multiple-choice questions, 4 hours; CEH Practical is a separate 6-hour hands-on exam | HR screening and some government requirements. See the CEH Certification Guide |
Choosing: for UK consultancy and public sector work, the CREST path and CHECK recognition matter; CREST notes that CHECK Team Leader and Member requirements are changing, so check NCSC and CREST for the current rules. For hands-on credibility with a report, OSCP is widely asked for. Where adverts list CEH for compliance reasons, it is a screening credential rather than proof of practical skill on its own. See the Cybersecurity Certifications Guide.
Progression
| Level | Typical titles | What changes |
|---|---|---|
| Junior | Junior or associate penetration tester | Tests under supervision, writes findings, shadows scoping calls |
| Mid | Penetration tester, security consultant | Runs standard engagements alone, writes full reports, debriefs clients |
| Senior | Senior consultant, team lead (CHECK Team Leader in UK public sector work) | Scopes engagements, leads teams, reviews reports, handles complex or sensitive tests |
| Principal or head | Principal consultant, head of offensive security | Methodology, quality, hiring, client relationships, research |
Specialist branches include red teaming, threat-led testing for financial regulators, application security, cloud, OT and AI system testing. Some testers move to purple teaming, detection engineering or security architecture, where knowing how attacks work improves defence. See the Threat-Led Penetration Testing Guide, Purple Teaming Guide and AI Red Teaming Guide.
Where the work sits in frameworks
| Framework | Reference |
|---|---|
| NICE Framework v2.0.0 | Vulnerability Analysis work role, task T1091 |
| NIST SP 800-53 Rev. 5 | CA-8 Penetration Testing, CA-8(1) Independent Penetration Testing Agent or Team, CA-8(2) Red Team Exercises, RA-5 Vulnerability Monitoring and Scanning |
| NIST CSF 2.0 | ID.RA-01 vulnerabilities identified, validated and recorded; ID.IM-02 improvements identified from security tests and exercises |
| CIS Controls v8.1 | Control 18 Penetration Testing |
| ISO/IEC 27001:2022 Annex A | 8.8 management of technical vulnerabilities |
Measuring your progress
- Report review return rate: how often a reviewer sends findings back for weak evidence or inflated severity.
- Retest pass rate: share of your recommended fixes that clients implement and that hold on retest.
- Engagement types led: number of distinct test types you can scope and run alone.
- Scope incidents: zero is the only acceptable number.
Where identity fits
Many of the most serious findings in modern tests involve identities rather than software flaws: over-privileged service accounts, exposed API keys and tokens, and abuse of valid accounts (ATT&CK T1078). Testers who understand identity and non-human credentials write more useful findings. See the Service Account Security Guide.
Common failure patterns
- Testing without paperwork: starting on a verbal go-ahead, or testing a third-party host the client does not own.
- Scope creep: following an interesting path into an excluded system instead of stopping to ask.
- Tool-dump reports: pasting scanner output without validation, context or fixes.
- Severity inflation: rating everything critical, which teaches clients to ignore reports.
- Careless data handling: keeping client credentials and personal data in unencrypted notes after the engagement.
- Certification collecting: stacking credentials without lab write-ups or reports to show.
Practitioner checklist
- Read section 1 and section 3A of the Computer Misuse Act, or your local equivalent, before you touch any tool.
- Never test without written authorisation from the system owner and agreed rules of engagement.
- Build an isolated, resettable lab with Windows, Linux, a small domain and a cloud tenant.
- Write a full report for every lab exercise, with risk ratings and fixes.
- Choose certifications by the job adverts in your target market, not by popularity.
- Join only bug bounty programmes with published rules and stay within them.
- Encrypt and minimise any sensitive data you collect, and delete it as agreed.
- Ask a senior tester to review your reports and track what they send back.
- Pick a specialism by year two: infrastructure, applications, cloud, OT or red team.
Standards and references
- legislation.gov.uk: Computer Misuse Act 1990, section 1
- legislation.gov.uk: Computer Misuse Act 1990, section 3A
- NICCS: NICE Framework Work Role, Vulnerability Analysis
- NCSC: Penetration testing
- NCSC: CHECK penetration testing
- CREST: Registered Penetration Tester (CRT)
- OffSec: OSCP+ Exam Guide
- GIAC: Penetration Tester (GPEN)
Related NHI Mgmt Group resources: Penetration Testing Guide · OSCP Certification Guide · CEH Certification Guide · Cybersecurity Careers Guide · Penetration Testing Provider Buyer's Guide