Penetration testing (pentest)

On 11 September 2019 two Coalfire testers, Gary DeMercurio and Justin Wynn, were arrested inside the Dallas County courthouse in Iowa in the middle of a commissioned physical intrusion: the contract did not say clearly who, the state or the counties, authorized what. The charges were dropped in early 2020. A penetration test, or pentest, is a security assessment exercise in which mandated experts attempt to compromise an organization's systems by replicating the methods and tools used by real attackers. The objective is to identify exploitable vulnerabilities before a malicious actor does so. Three main modalities are distinguished by the level of information provided to testers. In black-box testing, testers only know the target's name, like an external attacker. In white-box testing, they have full architectural and source-code information. Gray-box testing, the most common intermediate situation, provides partial information. A red team is an advanced form of exercise that simulates a complex attack in its technical, human and physical dimensions, seeking to test all of the organization's defensive capabilities including SOC and CIRT. A bug bounty is a continuous program in which security researchers are paid to report vulnerabilities. For cyber underwriting, a recent pentest report is a key document that provides a concrete image of the insured's attack surface, distinct from declarations alone. Insurers may require it for high limits or use it as a premium-reduction criterion.