Most organisations that ask “should we have a penetration test?” aren’t really thinking about exploits or technical mechanics. What they are really wrestling with is uncertainty: uncertainty about exposure, uncertainty about risk, and uncertainty about whether their security decisions are grounded in evidence or assumption.

A penetration test is often cast as a kind of security rite of passage — something you do annually, something you mention in board reports, something that looks good on a checklist. But when treated that way, it rarely delivers meaningful value.

The real question isn’t should we do a pen test because someone says so? — It’s will this activity address a real gap in our understanding or assurance of risk?

Before answering that, we have to unpack what penetration testing is really for — and where it sits relative to other kinds of assessment and confidence-building activities.

In everyday organisational language, commissioning a penetration test usually means one of three things:

A penetration test is a controlled exercise where skilled testers attempt to emulate how attackers might breach systems and achieve impact — it is a simulation of adversarial behaviour, not a guarantee of absolute safety.

When framed this way, the purpose becomes clearer: a pentest is a way to translate potential weaknesses into demonstrated risk. It isn’t a meter on posture, it is a spotlight on realistic exploitation — if the problem really exists.

That differentiates it from other activities that might feel like security work but are conceptually different in intent and output.

A penetration test has a specific role and shines brightest in particular situations:

Organisations often learn more from what a penetration test shows them about their assumptions than from the specific vulnerabilities it uncovers.

In that sense, a pentest is less about “finding holes” and more about testing confidence.

This is critical: a penetration test becomes useless when it is treated as a checkbox.

Too often, organisations commission penetration tests with hidden expectations:

These are understandable motives — they come from pressure to demonstrate activity — but they skew the purpose.

A penetration test is not a locker-room badge. It does not certify “good security”. It shows what a skilled adversary could accomplish within defined scope and constraints. If scope is arbitrary or intent is ambiguous, the results are almost guaranteed to be unhelpful.

Penetration tests are most effective when they are commissioned with clarity about what decision they are meant to inform.

Here are common scenarios where a well-scoped pen test delivers real value:

In these cases, a penetration test fills an important gap: it turns theory into evidence that stakeholders can understand and act upon.

Often, high-quality penetration testing highlights not only technical weaknesses, but also unexamined assumptions about systems, processes, or ownership — which are the real sources of risk many organisations miss.

This is just as important, and frequently overlooked.

There are situations where commissioning a penetration test will waste time, money, and attention — because it doesn’t actually address the core uncertainty you are grappling with.

You should avoid commissioning a pentest when:

In these situations, other forms of assessment — such as posture reviews, risk assessments, or governance evaluations — often provide better insight and prepare the organisation to get value from a subsequent penetration test.

The purpose of testing is to improve decisions, not to end them.

It’s also worth clarifying how penetration testing relates to other common security activities:

None of these activities is inherently superior — they serve different purposes. The best security programmes blend them intelligently, using each where it contributes uniquely to understanding risk.

A penetration test adds value when it satisfies three conditions:

When these are in place, a penetration test brings insight that simply cannot be obtained by scanning or evidence collection alone.

Penetration testing is not a ritual. It is not a marketing asset. It is not a substitute for good governance and strong controls.

It is a targeted exercise designed to turn assumptions into evidence — and it is only as valuable as the questions you ask of it.

If you are clear about why you want to do a penetration test, what decisions will be influenced by its findings, and how you will act on those findings, then it is very likely worth doing.

If you are asking the question because it feels like something you “ought to do”, then take a step back and ask a different question: what risk decision are we trying to make today that a penetration test would clarify?

Answering that will tell you more than a penetration test ever could.