Pentesting



  • Uses tools like Nessus, OpenVAS, or Qualys
  • Identifies known vulnerabilities based on signatures
  • No exploitation; no human analysis.

Good for Baseline compliance

These are more like something you would include in a technical checklist



  • Includes manual testing + automated tools (e.g. Burp Suite, Nmap, Metaspoilt).
  • Simulates an attacker with limited time and knowledge.
  • Exploits basic vulnerabilities (e.g. SQLi, XSS, weak credentials).
  • Includes a report with severity ratings and remediation advice.

Good for small businesses, SaaS vendors, SOC2, HIPAA, and is often required for security questionnaires



  • Simulates more skilled attackers or insider threats.
  • Includes chained attacks, privilege escalation, pivoting through networks.
  • Bypasses security controls like WAFs or rate limits.
  • Often covers web apps, APIs, networks, and authentication together.

Good for mid-sized companies, regulated industries, cloud-native systems. Includes customized test scenarios (e.g. “assume breached credentials”)



  • Long-term, stealthy simulation of a real-world adversary.
  • Includes social engineering, phishing, custom malware, and lateral movement.
  • Focused on testing detection and response, not just finding flaws.
  • Usually includes blue team (defender) evaluation.

Good for: Enterprises, security-mature orgs, requires coordination, NDAs, and predefined rules of engagement