Why a penetration test?

As soon as a company handles sensitive data for a larger customer, that customer wants to be sure it won’t become their weak link. This runs through supplier security questionnaires, and sometimes the requirement of a recent penetration test. Being able to answer “yes, here is the report and the retest” unlocks a contract; not being able to answer sometimes loses it.

Cyber-insurance has tightened. To grant cover, or to pay out after an incident, insurers increasingly ask for proof of real security measures, including regular testing. A penetration test documents what you have checked and fixed: exactly the kind of evidence an insurer values, and which can weigh on your premium.

Many frameworks and certifications expect periodic security testing, for instance as part of an ISO 27001 effort. The regulatory landscape is tightening too: the EU NIS2 directive extends cybersecurity obligations to a far wider set of organisations, including mid-sized and smaller companies in sectors deemed essential or important. Without mandating a pentest everywhere by name, these requirements push you to demonstrate that you truly test your security, not just that you have documented it.

Whether or not you are asked, the point stays the same: knowing what an attacker would really get, before they try. A penetration test produces not a decorative certificate but datable, reproducible evidence: flaws found, their severity, and retest confirmation that they are fixed. Useful to show, and above all useful to live with.

A client or insurer is asking you for a test? Tell me the context and I’ll say what is realistic within your deadline. See also what is a penetration test and how much it costs.