Explain like I'm five · Security

What is a Pentest?

Penetration testing, told as a story about the friendly thief we hired ourselves.

Solid! Don't worry?really?

How do you know the wall is solid?The guard says so, the builder says so. What would a thief say?

emptythere was a crack there?thieves find cracks best — and never tell you

If a real thief tells you, it's already too late.Thieves find cracks best — and never tell you. → the hole nobody knows about

CONTRACThow far: the vaulthow long: 3 daysnever: break things✓we hired himcome in like a real thief — under a signed agreement

A pentest is a friendly thief we hired.We ask them to break in like a real thief — under an agreement: how far, how long, what's off limits.

The contracthow far, how long
Like the real thingthe thief's own tricks
Break nothingjust proof they got in
The reporthow they got in
THE WAY IN · REPORT1got a key with a fake letter→ use the ring2old board at the tunnel mouth→ nail the board on3the vault in 40 minutes→ split the hallwayfixing is the castle's job

When it's over, you get a map of how they got in."Fake letter → tunnel mouth → vault, 40 minutes." And how to stop it. The fixing is the castle's job — starting with the boards.

last spring✓ all fixedthis month's new cracka pentest is a photo of that dayso it's done ofteninside the contractoutside itnever looked herethe storehouse outside the scope stays as it was

Cracks not found that day stay right where they are.A pentest is a photo of that day. Next month's crack isn't in it, and the storehouse outside the contract was never looked at. So do it often and wide — and keep a standing team (red team) probing too.

In one breath

A pentest = a friendly thief we hired. Within an agreed scope they break in like the real thing, then hand over a map of how they got in.

Unlike a vulnerability scan (listing cracks with a magnifying glass), a pentest actually breaks in. A red team does it longer and quieter. A bug bounty pays anyone who brings a crack.

When grown-ups say it

Scope
The contract — how far. Up to the vault? Not the storehouse? Decided in advance.
Rules of engagement
What's off limits. Break nothing, nights only, never touch real customers.
Black-box · white-box
Without a map · with one. Start knowing nothing like a real thief, or with the castle's plans in hand.
Scan vs. pentest
A list of cracks · actually getting in. A scan is a magnifying glass; a pentest is a ladder. → finding cracks
Red team
The hired thief who stays longer and quieter. Weeks to reach the goal unseen — partly to test whether the guard room notices.
Blue team
The defenders. The guard room, the dog, the watchers. → the guard room
Report
The way-in map plus what to fix first. The most valuable piece of paper a pentest produces.
Bug bounty
A reward for anyone who finds one. Friendly thieves you didn't hire. → the hole nobody knows about
Next story
The Order of Things When a Thief Gets In →
Want another term as a picture book? Request →