A penetration test into Advanced Persistent Threats is essentially a simulated attack against the Client using the same methodologies and strategies as those used by cyber-criminals, and comes in many forms. A ‘white box’ test gives the Pen Tester advanced knowledge of all systems so that each may be thoroughly tested against a bespoke program; a ‘black box’ test on the other hand, starts the Pen Tester from zero and allows them to create the specific journey of a hacker finding their way into the vulnerabilities without knowing what they will find. 

Whether white- or black-box, penetration tests can also be enacted with specific reference to breaching a Client’s critical infrastructure, compromising Supervisory Control & Data Acquisition (SCADA) plants, plotting a path to the (simulated) theft of very particular data, or via a social engineering ‘phishing audit’ to explore the faultlines in employees (who, with little training on how to spot fraudulent emails or in their ignorance of following best-practice directives, are often the biggest security risk in any company). 

A wider footprint must be considered as well: examining the security of wireless networks which present an invisible and overlooked attack route into the core of an organisation entirely remotely, or web applications and client portals that provide a backdoor for determined attackers.