Testing like an attacker
An organisation gives testers permission to look for ways into a system. For example, can a website visitor see someone else’s private information? Testers show what they find within agreed limits.
Their report explains the security weaknesses, possible harm, and fixes. A vulnerability scan uses automated checks. A red-team exercise may also test whether the organisation notices and responds to an attack.
Agree the limits first
Both sides first agree what can be tested, when, and how. The test captures one point in time, so the organisation needs to fix weaknesses and check the fixes.