DAST
Continuously monitor web applications for vulnerabilities at scale with Cobalt Dynamic Application Security Testing (DAST).
DAST
Continuously monitor web applications for vulnerabilities at scale with Cobalt Dynamic Application Security Testing (DAST).

From Pen Test to Pentest

One Small Space, One Big Transformation

The English language evolves and changes over time and new words are created. In many cases, simply combining the different sounds from two words can make a new one. “Smog” from smoke and fog, “malware” from malicious and software, and internet from inter-networking are just a few examples. There’s even a term for these words — portmanteau words — a reference to a suitcase with two compartments.

According to the Merriam-Webster dictionary:

In Lewis Carroll’s Through the Looking Glass, Alice asks Humpty Dumpty to explain words from the nonsense poem “Jabberwocky” and is told that slithy is “like a portmanteau — there are two meanings packed up into one word.”

In the application security space, we have created a portmanteau of our own, the formal combination of “penetration” and “test” into pentest. With this post we would like to propose that there is also a different semantic meaning between “Penetration Test” and “pentest”.

Why all the grammatical fuss?

Clarity and consistency are two big reasons. Over the past decade terms like “penetration test,” “pen test” and the capitalized combo, “PenTest” have all been used, but we believe there’s an important distinction to be made by using the verb pentest. A “penetration test” and “pentest” today reflect very different things. When technology evolves and processes change, the words we use should convey what is actually provided.

As computers gained the ability to exchange data across communication lines in the mid-1960s, computer security experts recognized the risk of hackers penetrating those communication lines. Government and businesses created teams that would go on the hunt for vulnerabilities and test the ability of computer networks to resist attack.

Initially it doesn’t sound all that different from what we still see today. We suggest that a penetration test is a discrete event, typically covering a single system and resulting in a static report. Many providers are still delivering penetration tests, perhaps on an annual or semi-annual basis with the subsequent PDF report of vulnerabilities.

But a lot has changed in forty years, especially when it comes to software development. In an era when enterprise software applications took years to develop and subsequent updates also had their own lifecycles, a penetration test was conducted and the report was used to fix vulnerabilities prior to release. Can the same process deliver value when software is pushed out daily on APIs, mobile platforms and the cloud?

Through the Looking Glass begins with Alice climbing through a mirror to a world she sees beyond it. We believe we are already there and our wording just needs to catch up.

That’s where “pentest” comes in. Pentest is a verb that occurs frequently (pentesting), if not constantly. It’s the smaller, faster, more agile offspring of its grammatical relative. Pentesting is the logical and necessary solution to enhance the security of modern software development practices that are operating on demand in the cloud.

A penetration test denotes a single event in time, whereas pentesting occurs in real time. You can and should pentest an app, and we want more developers and security teams to ‘pentest apps’ on an ongoing basis. By removing one small space, we strive to eliminate a big space between the security experts who find vulnerabilities and the software experts who fix them — whether you think of that “space” in terms of development cycles or security risks.

Learn more about Cobalt’s, Pentest as a Service (PtaaS) platform.

Back to Blog
About Jacob Hansen
Jacob Hansen is a Co-founder and Board Member at Cobalt, a fully remote cybersecurity company with a mission to modernize traditional pentesting via a SaaS platform coupled with an exclusive community of highly skilled testers. He formerly worked as Cobalt's Chief Executive Officer for nearly 10 years. Jacob's mission is to evolve traditional penetration testing services by engaging the best cybersecurity talent, via Cobalt’s Pentest as a Service (PtaaS) platform, and allowing customers to move from a static pentest to platform-driven pentest programs that drive better security and improve customer's return on investment. More By Jacob Hansen
What is Continuous Pentesting?
Learn more about how a continuous pentesting program with Agile Pentesting helps improve your security posture.
Blog
Jun 23, 2023
Pentester Diaries: Full-time Freelance Pentesting
This episode of Pentester Diaries is about the benefits of being a full-time freelance pentester. I sat down with Core Pentesters Harsh Bothra and Parveen Yadav to talk about their daily lives and how they manage to be a full-time freelancer.
Blog
Sep 14, 2022