Penetration testing is a hired, controlled attack on your own systems. A tester tries to break in the way a real attacker would, then reports what they reached and how to close each gap. Unlike a vulnerability scan, which lists known weaknesses, a pen test shows whether those weaknesses can actually be used to get to your client data.
For most small businesses, a pen test comes after the basics, not before. MFA, patching, backups and staff training close more doors first. For financial firms under the FTC Safeguards Rule, an annual pen test is required unless you have effective continuous monitoring in place, along with vulnerability assessments at least every six months. Firms holding customer information on fewer than 5,000 consumers are exempt from that schedule, though they still have to test or monitor their safeguards regularly. If your cyber insurer or a large client asks for a test, that usually settles the question whatever the rule says.
What a pen test actually is
The FTC's rule defines it plainly. Penetration testing is "a test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting penetration of databases or controls from outside or inside your information systems" (16 CFR 314.2).
In practice that means a person, not just a program, trying things. They might try passwords that leaked in other breaches against your email. They might look for a forgotten remote login that's open to the internet. If they get onto one laptop, they see how far they can move from there. A good tester thinks like the attacker who wants your client files.
At the end you get a report. It should say what they tried, what worked, how serious each finding is, and what to fix.
There are a few kinds you'll hear about.
| Type of test | Where the tester starts | What it shows you |
|---|---|---|
| External test | On the internet, where any attacker starts | Whether your website, email, firewall and remote logins can be broken into from outside |
| Internal test | Inside your network, as if one employee was already phished | How far a single mistake would let an attacker reach |
| Social engineering test | Fake phishing emails or phone calls to staff | Whether people will hand over passwords or access |
Pen test vs. vulnerability scan
People mix these up all the time, and some providers sell one under the other's name.
A vulnerability scan is automated software that checks your systems against a list of known weaknesses. It's broad, fast and cheap to repeat. Our vulnerability assessment guide covers it in detail.
A pen test is narrower and deeper. A person takes what a scan might find and tries to actually use it, chaining small problems into a real break-in. It tells you whether a weakness matters, not just that it exists.
If a provider quotes you a "pen test" and it's a scan report with a logo on it, that isn't a pen test.
What the FTC Safeguards Rule says about penetration testing
Firms covered by the rule have to "regularly test or otherwise monitor the effectiveness" of their safeguards (16 CFR 314.4(d)(1)). That part applies to everyone.
The next part, 314.4(d)(2), is where pen testing comes in. Your monitoring and testing "shall include continuous monitoring or periodic penetration testing and vulnerability assessments." If you don't have effective continuous monitoring, the rule says you must do two things.
- Annual penetration testing, scoped each year based on the risks in your risk assessment.
- Vulnerability assessments at least every six months, and also whenever there are material changes to your business or anything you know may affect your security program.
So the rule gives you a choice. Watch your systems continuously, or test them on a schedule. The rule doesn't define continuous monitoring in its definitions section, but the text describes it as systems that detect, on an ongoing basis, changes that may create vulnerabilities. Many IT providers point to a managed detection and response service for this, where a team watches alerts around the clock. Ask your provider which path you're on and how they'd show it.
There's an exemption. Firms that hold customer information on fewer than 5,000 consumers don't have to meet 314.4(d)(2) at all (16 CFR 314.6). They still have to regularly test or monitor under (d)(1). They just aren't held to the annual pen test or the six-month schedule.
Count carefully before you rely on that. Years of retained client files add up. Our FTC Safeguards Rule guide explains who's covered.
Penetration testing for small business: do you need one?
Here's how we'd think about it.
If you're covered by the rule, over 5,000 consumers, and not doing continuous monitoring, you need an annual pen test. That's the plain reading of the text.
If you have continuous monitoring in place, a pen test isn't required by (d)(2), but it can still be worth doing. Monitoring tells you when something happens. A pen test tells you what could happen before it does.
If you're under 5,000 consumers, it isn't required. Get the basics right first. MFA, patching, backups and training close more doors for less money than a pen test will.
If your cyber insurer or a large client asks for one, that settles it, whatever the rule says.
A pen test on a network with no MFA and months of missed updates mostly tells you what you already knew. It's more useful after you've fixed the obvious things, when you want someone to find what you missed.
What to ask before you hire a tester
- Is a person doing the testing, or only software? You want both, with a person leading.
- What's in scope? External only, internal too, cloud apps, Wi-Fi, staff? Tie the scope to your risk assessment, which is what the rule asks.
- Who's doing it? Ask about the tester's experience with firms your size. Ask whether the work is subcontracted.
- What will the report look like? Ask for a sample. You want findings ranked by severity, plain-English explanations, and steps to fix each one.
- Is a retest included? After you fix things, someone should confirm the fixes worked.
- How do they protect your data? They may see client files during the test. Get the handling rules in writing, and treat the tester as a service provider you oversee, as the rule requires for any vendor with access.
- Is it independent? If your IT provider tests its own work, ask how they keep that honest, or bring in someone separate.
After the test
The report is the start, not the finish. Fix the high-severity findings first and set dates for the rest. Keep the report, your fixes and the retest results together. The rule also asks you to adjust your security program based on testing results, under 314.4(g), so note what changed.
Where to start
Find out which path you're on today, continuous monitoring or scheduled testing, and whether you're over the 5,000 line. If you don't know, our security check gives you a plain score and can match you with one IT company that works with firms like yours.