Penetration testing

Penetration testing and vulnerability assessment for companies and public bodies: what is tested and what you keep

A vulnerability assessment looks for the known weaknesses in your systems and applications. A penetration test tries to exploit them, as an attacker would, within a scope authorised in writing. At the end, management receives a clear summary, IT receives the technical detail and everyone gets a remediation plan with a retest.

Let’s talk about the scope The differences in brief

Example graphic: a penetration test report with the findings ranked by severity, the proposed fix and the status of the retest. — Example · not a real test

Written authorisation: before every test, from whoever has legal authority over the systems
Fixes ranked by severity: with who makes them and an agreed retest
Summary for management: written to be discussed by the board

01 · copy the link to this sectionThe differences

Vulnerability assessment or penetration test: what changes

They are two different tools. Usually the first prepares the second.

In short: a vulnerability assessment tells you where you are exposed. A penetration test tells you how far someone gets once they are in.

Item	Vulnerability assessment	Penetration test
What it does	Looks for known weaknesses with tools and checks, across many systems	Tries to exploit the weaknesses and chain them together, as an attacker would
The question it answers	Where are we exposed?	How far does an intruder get?
Manual work	Little. Much is automated, then false alarms are removed	A lot. A person decides every step
Effect on systems	Usually light	Possible, which is why time windows and limits are agreed
When you need it	Often, and after every major change	On the systems that matter most, before a launch or when a client asks
What you keep	A list of weaknesses ranked by severity	The path of the successful attack, the evidence and the fixes in order

02 · copy the link to this sectionWhat is tested

Types of test, from the website to people

The scope is chosen with management and IT. You do not need to test everything every time.

CYB External network Everything anyone can reach from the internet: websites, email, remote access, services published by mistake.

CYB Internal network What someone already inside can do, for example from an infected computer or the guest network. We look at how easy it is to reach the servers and the backups.

CYB Web applications, APIs and AI assistants Permissions, sessions, other users’ data that should not be visible. In AI assistants, instructions hidden in content too.

CYB Mobile apps The data stored on the phone and the exchange between the app and the server.

CYB Wi-Fi and premises Wireless networks, guest separation, sockets and rooms where an outsider could plug in.

CYB

People (social engineering)

Emails, phone calls and visits that try to obtain access. Only under written rules agreed with management. Training and phishing simulations

03 · copy the link to this sectionHow we work

How it runs, from scope to retest

Five steps. No test starts without written authorisation from whoever has legal authority over the systems.

Scope and rules of engagement

Systems and addresses to test, test accounts, exclusions, time windows, contact people. We also write down what to do if something serious turns up during the test.

Written authorisation

It is signed by whoever has legal authority over the systems. If a system is hosted by a provider, we also check the provider’s testing rules.

Testing window

The test runs on the agreed dates. Anything that could affect production runs at times chosen with IT, with a contact person available.

Report and remediation plan

A summary for management, the technical detail for the people who run the systems and the fixes ranked by severity.

Retest

The fixed weaknesses are tested again and the status of each item is updated. The date is agreed in the plan.

How long does it take?: It depends on the scope: how many systems and applications, and whether the test starts from outside or with a user’s credentials. The duration is set out in the proposal.
Who makes the fixes?: For each item, the report says who can carry it out. The order is decided with your IT team, based on severity.

04 · copy the link to this sectionWhat you keep

What management receives, and what IT receives

Summary for management. The risks in plain language, the priorities and the decisions to take. It takes a few minutes to read.
Technical detail. Each weakness with the evidence, how to reproduce it and how to fix it.
Remediation plan. Who does what, by when, and the date of the retest.
A summary for clients and insurers, if needed. It states what was tested and when, without revealing the details of the weaknesses. It is not a security certificate.

05 · copy the link to this sectionReference

How often to repeat a penetration test

Updated 7 November 2026

In short: there is no single interval for every company. What counts is how often your systems change and what clients and sector rules require.

Vulnerability assessment. More often than a penetration test, because new weaknesses come out all the time. Repeat it after every major update.
Penetration test. On the most important systems, as a rule once a year, and straight after a major change such as a new application or a move to the cloud.
EU banks and insurers. The DORA regulation requires certain financial entities to carry out threat-led penetration testing at least every three years (Article 26).
NIS2 entities in Italy. Among the documents the ACN lists for the basic measures is a vulnerability management plan.

The intervals given as a rule are our recommendation, not a legal requirement. What applies to a particular company is decided with management and, where needed, with its lawyers.

Sources (consulted on 7 November 2026)

06 · copy the link to this sectionPrinciples

What we don’t do

No test without written authorisation, and no test outside the signed scope. In Italy and San Marino, unauthorised access to a system is a crime.
No test sold as a guarantee. The report describes the systems tested on the date of the test.
No certification. We document what was tested and fixed. Formal assessments are for those with the authority to make them.
No disclosure of results. They stay with you.

07 · copy the link to this sectionFrequently asked questions

Frequently asked questions about penetration testing

What is the difference between a vulnerability assessment and a penetration test?

A vulnerability assessment looks for the known weaknesses in your systems and applications, largely with automated tools. A penetration test tries to exploit them and chain them together, as an attacker would, and shows how far it gets. The first tells you where you are exposed, the second what happens if someone gets in.

How often should a penetration test be done?

No single legal interval applies to every company. As a rule, it is done once a year on the most important systems and straight after a major change. Some sector rules set their own intervals, such as DORA for certain financial entities, which requires advanced testing at least every three years.

Can a penetration test bring systems down?

The risk exists, which is why it is reduced beforehand. Time windows and limits are agreed, the heaviest tests are left out on delicate systems and a contact person from your company stays available. If something goes wrong, the test stops.

How much does a penetration test cost?

It depends on the scope: how many applications and addresses we test, whether the test starts from outside or with a user’s credentials, and how much manual work it needs. That is why there is no price list. The first conversation carries no commitment. If there is work to be done, you receive a written proposal for the initial assessment, usually one or two days of work with the people involved. After the assessment comes the proposal for the project, with phases, timing and costs.

Can a penetration test cover cloud systems or systems run by a provider?

Yes, with the right authorisations. The company with legal authority over the systems signs, and the provider’s testing rules are respected. Where needed, the provider is told in advance.

08 · copy the link to this sectionObservatory

From the Observatory: testing, attacks and suppliers

Analysis and guides from the Strategic editorial team.

CYBCybersecurity

How much does a penetration test cost? What drives the price, and two questions to ask first

The price of a penetration test depends on scope, approach, manual work, documentation and retesting. How to read a quote, what the rules require and what should be left once the test is over.

22 July 2026

CYBCybersecurity

Imaginary letter from a reformed attacker: how targets get chosen

An imaginary story told from the attacker’s side. Targets are not chosen, they are found. We look at the three signals that make an attacker move on, and at how they become concrete rules in a company.

9 April 2026

CYBCybersecurity

Breaches discovered late: why you need to look beyond your own perimeter

Many intrusions leave traces outside the company before they show any sign inside: credentials for sale, domains imitating the brand, suppliers that have been hit. Which signals to check and what to do when they appear.

5 August 2026

CYBCybersecurity

Supplier and contractor access to company systems: the door nobody controls

Remote support, shared accounts, programs installed years ago and never removed. Supplier access is one of the most exploited ways in. How to list it, limit it, log it and close it.

12 October 2026

All cybersecurity articles

The essential parts of this page print as a short summary of a few pages, without images or invitations to get in touch.

09 · copy the link to this sectionContact

Write to us about a penetration test

A few lines are enough: what needs testing, why, and any deadlines. We reply by email, usually within two working days.

Please do not put credentials, IP addresses or vulnerability details in the form. We exchange them later, over the channels we agree.

Or write to us:WhatsApp staff@strategic.sm

On WhatsApp, messages are answered by Strategic’s AI assistant. Please do not use it for confidential information.