Penetration Testing Steps: The 7 Phases Explained

A penetration test follows a repeatable set of phases — most commonly seven — that take a target from an agreed scope all the way to a validated, fixable set of findings. Different guides count five, six, or seven steps, but they describe the same journey: plan the test, map the target, find and prove the weaknesses, then report and verify the fixes. This guide walks each phase in plain English, including how long they take.

Last updated: 2026.

Key Takeaways

• A penetration test follows a repeatable process — most models describe five to seven phases — so results are consistent and comparable.
• The core flow is scoping and rules of engagement, reconnaissance, scanning and enumeration, vulnerability analysis, exploitation, post-exploitation, and reporting with a retest.
• Each phase has a job: recon maps the target, scanning finds weaknesses, exploitation proves which are actually dangerous, and reporting turns findings into fixes.
• A traditional test runs days to a few weeks, plus reporting and a later retest — but automated testing can compress the full cycle to hours.
• The steps are the same whether the target is a network, a web app, or an API; what changes is the tooling and the scope.

The Penetration Testing Process at a Glance

Before the detail, here's the whole journey in order:

1. Scoping and rules of engagement
2. Reconnaissance
3. Scanning and enumeration
4. Vulnerability analysis
5. Exploitation
6. Post-exploitation and lateral movement
7. Reporting, remediation, and retest

Everything below expands on these seven steps. If you'd rather see the general concept first, our pillar guide covers what penetration testing is; this article is the practical walkthrough of how one actually runs.

How Many Phases Are There? 5 vs. 7

You'll see pen testing described as five phases, six, or seven, and it causes needless confusion. It's the same process at different levels of detail. The classic five-phase model folds pre-engagement into "planning" and rolls post-exploitation into "exploitation." The seven-phase model simply pulls those two out on their own, because in a real engagement they matter enough to name. We use seven here, which also lines up with the framework-level view in our penetration testing methodology guide, where the standards behind the phases — PTES, OWASP, and NIST — are compared in depth. If you only remember one thing: the number of boxes doesn't change the work, only how finely it's sliced.

Step 1 — Scoping and Rules of Engagement

Every legitimate test starts with agreement, not attack. In this pre-engagement phase, the client and tester define exactly what's in scope — which systems, applications, IP ranges, and accounts — and, just as importantly, what's out of bounds. They set the goals (compliance, a specific worry, general assurance), the timing windows, and the rules for handling anything sensitive that turns up. This is also where written authorization is signed. That authorization is what separates a penetration test from a crime, so nothing else begins until it's in place.

Step 2 — Reconnaissance

With scope agreed, the tester builds a picture of the target. Reconnaissance splits into two modes. Passive recon gathers information without touching the target directly — public records, DNS data, exposed subdomains, employee details on LinkedIn, leaked credentials in old breaches. Active recon interacts with the target lightly to confirm what's live. The goal is to understand the real attack surface before firing a single exploit, because an attacker who knows the terrain is far more effective than one who guesses.

Step 3 — Scanning and Enumeration

Now the tester maps the target in technical detail. Scanning discovers open ports, running services, and software versions; enumeration digs into each of those to list users, shares, endpoints, and configurations. This is where automated scanners earn their place — they cover ground quickly and flag candidate weaknesses. But scanning produces possibilities, not proof, which is why it's a step in the process rather than the whole thing.

Step 4 — Vulnerability Analysis

Raw scan output is noisy. In this phase the tester turns a long list of potential issues into a short list of plausible, prioritized weaknesses — separating false positives from findings worth chasing, and spotting how several small issues might combine into something bigger. It's worth stressing what this step is not: running a scanner and exporting its report is not a penetration test. The value comes from a human deciding what's real and what's reachable, which sets up the phase that proves it. For more on that distinction, see our guide on vulnerability assessment and penetration testing.

Step 5 — Exploitation

This is the phase most people picture, and the one that defines a pen test. The tester safely attempts to exploit the confirmed weaknesses — gaining access, extracting data, or escalating privileges — to prove real impact rather than theoretical risk. A finding that says "this port might be vulnerable" is a guess; a finding that says "we used this port to read your customer database" is a fact. Proof over theory is the whole point, and it's what makes the final report worth acting on.

Step 6 — Post-Exploitation and Lateral Movement

Getting in is rarely the end of the story; the damage comes from what happens next. In post-exploitation, the tester explores how far a foothold can spread — escalating privileges, moving laterally to other systems, reaching sensitive data, and testing whether access can persist. All of it stays within the agreed scope and is done carefully, but it answers the question that matters most to a defender: if an attacker got this far, how bad would it be? That blast-radius picture is often more valuable than the initial break-in.

Step 7 — Reporting, Remediation, and Retest

The deliverable is the point of the whole exercise. A good report ranks findings by severity, usually with CVSS scores, and pairs each one with proof and clear remediation guidance. It typically comes in two layers — an executive summary for decision-makers and technical detail for the engineers who'll fix things. Reporting isn't the finish line, though. The team remediates the issues, and then a retest confirms the fixes actually worked and didn't introduce new problems. Only then is the finding truly closed.

How Long Does a Penetration Test Take?

Timing depends on scope and complexity, but a typical engagement follows a rough shape. Scoping takes a few days of back-and-forth. Active testing — steps two through six — usually runs from several days to about two weeks. Writing the report adds a few more days, and the retest happens later, once fixes are in. So a standard project spans a few weeks end to end. The big variables are how much is in scope and how complex the targets are. It's worth noting that automated and continuous testing changes this math entirely, compressing the active cycle from weeks into hours.

Tools Used Across the Phases

No single tool runs a pen test; each phase has its favorites. Reconnaissance and scanning lean on tools like Nmap for mapping and Nessus or OpenVAS for vulnerability discovery. Exploitation reaches for frameworks like Metasploit and, for web targets, Burp Suite. Reporting has its own tooling to turn findings into a clean deliverable. The constant across every phase is that tools assist judgment rather than replace it — and increasingly, AI is taking on more of the repetitive work. For the full toolkit, see our penetration testing tools guide.

How Automation and AI Are Changing the Process

The phases aren't going anywhere — you still scope, recon, exploit, and report — but how fast they run is changing. Autonomous agents can now carry a target through reconnaissance, exploitation, and reporting continuously, finishing in hours instead of weeks and verifying each finding with a working proof of concept, safely against production. This is the model BackDoor is built on: our agents run the full cycle on your external attack surface and hand back a report with proof per finding, then keep watching as that surface changes. What automation doesn't remove is the front of the process — scoping and authorization still require human agreement, and Step 1 stays exactly where it is. You can see the approach in action on our external penetration testing and website penetration testing pages.

Conclusion

Penetration testing is a disciplined, repeatable process that runs from an agreed scope to proven, fixable findings and a retest that confirms the fixes. The value isn't in a scan dump; it's in the exploitation and reporting phases, where guesses become facts and facts become a plan. Automation is compressing the cycle from weeks to hours without changing the phases themselves — and that's the model BackDoor brings to your external attack surface, proving each finding with a working exploit and re-checking it as your systems change.