So, what is penetration testing? In short, a penetration test is an authorised, simulated attack on your systems. A qualified tester tries to break in the way a real attacker would, then shows you exactly what they found and how to fix it.
Unlike an automated scan, a penetration test is led by a person. The tester chains small weaknesses together, tests business logic and proves what an attacker could actually reach. The result is a clear picture of your real risk, not just a long list of possible issues.
Why organisations run penetration tests
Most organisations commission a penetration test for one of four reasons:
- To find weaknesses before attackers do. Real attackers do not wait for your next audit. A test gives you the same view they would have, on your schedule.
- To meet regulatory or customer requirements. Regulators, auditors and large customers increasingly ask for independent security testing. In Malaysia, the Cyber Security Act 2024 (Act 854) also requires penetration testing providers to hold a licence from NACSA.
- Before a launch or a big change. A new mobile app, a payment feature or a cloud migration all deserve a test before they go live.
- After an incident. If something has already happened, a test helps confirm that the gaps are closed.
What does a penetration test cover?
A test is always scoped to specific targets. The most common types are:
- Web application testing. Login, session handling, access control, input handling and business logic in your websites and portals.
- Mobile application testing. Android and iOS apps, including how they store data and talk to their back-end APIs.
- API testing. REST and GraphQL endpoints that power your apps and integrations.
- Network and infrastructure testing. Internet-facing services, internal networks, Active Directory, firewalls and VPNs.
- Cloud configuration testing. Identity, storage and network settings in AWS, Azure or Google Cloud.
- Social engineering. Phishing simulations and other tests of how staff respond to manipulation.
How much the tester knows in advance also matters. We explain the options in black box, grey box and white box testing.
How a penetration test works, step by step
Good testers follow a recognised penetration testing methodology, such as the OWASP Web Security Testing Guide or PTES. In practice, most engagements follow the same flow:
- Scoping and rules of engagement. You agree on targets, testing windows, contacts and anything that is off limits. Both sides sign an authorisation before any testing starts.
- Reconnaissance. The tester maps your attack surface: domains, exposed services, technologies and user roles.
- Vulnerability discovery. Automated tools and manual techniques are used together to find weaknesses.
- Exploitation. The tester safely proves which weaknesses are real and how far an attacker could go.
- Reporting. You receive a report with each finding, its risk rating, evidence and clear remediation steps.
- Retesting. After your team fixes the issues, the tester verifies that the fixes work.
Penetration testing vs vulnerability scanning
The two are often confused, but they answer different questions.
A vulnerability scan is automated. It is fast, cheap and good for finding known issues across many systems. However, it produces false positives and cannot judge business impact.
A penetration test is manual and goal-driven. It confirms which issues are real, combines them into attack paths and finds logic flaws that scanners miss. In other words, scanning tells you what might be wrong, while a penetration test shows what an attacker could actually do.
Most mature organisations use both: regular scanning to stay on top of known issues, and periodic penetration tests for depth. For a full adversary simulation, see what is red teaming.
What a good penetration test report includes
The report is the main thing you pay for, so it should be useful to both managers and engineers. Look for:
- An executive summary that explains overall risk in business terms.
- Each finding with a severity rating, affected assets and step-by-step evidence.
- Practical remediation advice your developers can act on.
- A clear list of what was tested and what was out of scope.
How often should you test?
As a rule of thumb, test at least once a year and after any major change. High-risk systems, such as online banking, e-commerce checkouts and systems holding personal data, are often tested more frequently. Development teams can also add security checks to every release with DevSecOps.
Choosing a penetration testing provider in Malaysia
When you compare providers, ask about:
- Licensing. Under Act 854, penetration testing providers in Malaysia must be licensed by NACSA. RC.MY holds licence 20312-02.
- Methodology. Ask which standards they follow and how they test business logic, not just which tools they run.
- Sample reports. A redacted sample tells you a lot about quality.
- Retesting. Check that verification of fixes is included.
Frequently asked questions
Is penetration testing legal?
Yes, when it is authorised. A legitimate test always starts with written permission from the system owner and an agreed scope. Testing systems without permission is an offence.
Will a penetration test take my systems down?
A professional test is planned to avoid disruption. Risky tests can be scheduled outside business hours or run against a staging environment.
How long does a penetration test take?
A small web application may take three to five working days. A larger network or a multi-application scope can take several weeks, plus time for reporting.
Need a penetration test?
RC.MY is a NACSA-licensed penetration testing provider based in Selangor. We test web and mobile applications, APIs, networks and cloud environments for public and private organisations. Explore our cybersecurity services or contact us to scope your test.
