Penetration Testing
Authorised simulated attacks against systems and networks to identify vulnerabilities before adversaries do—providing defenders with an attacker's perspective.
What is Penetration Testing?
Penetration testing (pentesting) is the controlled practice of attacking your own environment to discover exploitable weaknesses. Unlike vulnerability scanning, pentesting validates whether vulnerabilities can actually be exploited and chains them together to demonstrate real-world impact.
Identifies potential weaknesses
Proves exploitability
Automated scanning
Manual + automated
Breadth-focused
Depth-focused
"This could be vulnerable"
"I got Domain Admin"
The goal: Find and fix weaknesses before threat actors exploit them.
Why SOC Analysts Should Care
Pentesting directly improves defensive operations:
Attack paths documented
Detection rule development
Techniques used
Purple team validation
Controls bypassed
Gap identification
Dwell time achieved
MTTD benchmarking
Logs generated
Alert tuning opportunities
{% hint style="info" %} Key insight: Every pentest is a detection engineering opportunity. If the red team moved laterally undetected, your detections have gaps. {% endhint %}
Types of Penetration Testing
External
Internet-facing assets
Perimeter defences, web apps, VPN, email
Internal
Inside the network
Lateral movement, privilege escalation, AD
Web Application
Specific applications
OWASP Top 10, business logic flaws
Wireless
WiFi networks
Rogue APs, WPA2 attacks, segmentation
Social Engineering
Human element
Phishing, vishing, physical access
Cloud
AWS/Azure/GCP
Misconfigurations, IAM, storage exposure
Pentest vs Red Team vs Purple Team
Pentest
Find vulnerabilities
Usually informed
Red Team
Test detection & response
Typically blind
Purple Team
Collaborative improvement
Fully integrated
For SOC improvement: Purple team exercises deliver the most value—attackers and defenders working together to validate and enhance detections in real-time.
The Pentest Lifecycle
Standard Techniques (What to Detect)
Recon
DNS enumeration, port scanning
Firewall logs, IDS alerts
Initial Access
Phishing, exploit public apps
Email gateway, WAF, EDR
Execution
PowerShell, scripting engines
Script block logging, AMSI
Persistence
Scheduled tasks, registry, services
Sysmon, autoruns monitoring
Priv Esc
Token manipulation, UAC bypass
Sensitive privilege use
Credential Access
LSASS dump, Kerberoasting
Credential access events
Lateral Movement
PsExec, WMI, RDP, SMB
Logon events, network auth
Exfiltration
DNS tunneling, cloud storage
DLP, proxy logs, DNS analytics
{% hint style="warning" %} Detection gap check: Review pentest reports for techniques that went undetected. Each one is a detection engineering backlog item. {% endhint %}
Pentesting's Role in Security Programs
Validates Controls
Confirms whether security investments actually stop attacks—or just generate dashboards.
Tests Detection Capability
Reveals blind spots in logging, alerting, and response procedures.
Demonstrates Risk
Translates technical vulnerabilities into business impact for executive communication.
Meets Compliance
Required by PCI-DSS, HIPAA, SOC 2, and numerous regulatory frameworks.
Drives Prioritisation
Exploitable vulnerabilities get fixed faster than theoretical ones.
Leveraging Pentest Results as a SOC Analyst
During the engagement:
Monitor for pentest activity (if aware)—validate your detections fire
Note timestamps of attacker actions for log correlation
Track which alerts triggered and which didn't
After the engagement:
Request detailed logs of all techniques attempted
Map findings to MITRE ATT&CK techniques
Build or tune detections for gaps identified
Create purple team scenarios from successful attack paths
Update runbooks with observed attack patterns
Key Metrics from Pentesting
Time to initial access
Perimeter effectiveness
Time to Domain Admin
Internal control strength
Techniques undetected
Detection coverage gaps
Mean time to detect (if red team)
SOC responsiveness
Critical findings count
Overall security posture
Remediation time
Vulnerability management maturity
Building Offensive Awareness
SOC analysts benefit from understanding attacker methodology:
Basic exploitation
Understand what alerts mean
Privilege escalation paths
Recognise post-compromise activity
AD attack techniques
Detect Kerberoasting, DCSync, etc.
Evasion methods
Anticipate detection bypasses
C2 frameworks
Identify beacon behaviour
Resources:
TryHackMe / HackTheBox — Hands-on practice
PNPT / OSCP — Structured learning paths
Atomic Red Team — Technique simulation
MITRE ATT&CK — Technique reference
Quick Wins
Read pentest reports — Understand what was found and how
Map to ATT&CK — Translate findings into detection opportunities
Request raw logs — Correlate pentest activity with your telemetry
Build detections — Create rules for techniques that bypassed controls
Run atomic tests — Simulate techniques to validate new detections
Join purple teams — Collaborate directly with offensive testers
Penetration testing tells you what's broken. Detection engineering ensures you see it next time.
Last updated