Penetration testing PENT
The assessment of organisational vulnerabilities through the design and execution of penetration tests that demonstrate how an adversary can either subvert the organisation's security goals or achieve specific adversarial objectives. Penetration testing may be a stand-alone activity or an aspect of acceptance testing prior to an approval to operate. The identification of deeper insights into the business risks of various vulnerabilities.
Moving to SFIA 8
There is an updated version of this skill for SFIA 8.
- Supports employability with additional level at level 3 based on demand from apprenticeships/industry placements
- Descriptions have been updated to align with the creation of a stand-alone Vulnerability assessment skill for SFIA 8
- The overall description of the skill has been re-worded to provide more focus on why this skill is different than the Testing TEST skill
- The skill descriptions have been edited for readability and guidance notes have been added
- Details available here - SFIA 8 Penetration testing
- SFIA 7 skill descriptions will remain available for you to use
- Previous SFIA assessments may be impacted by this change.
Levels of responsibility for this skill
| 4 | 5 | 6 |
Penetration testing: Levels 1-3
This skill is not typically observed or practiced at these levels of responsibility and accountability.
Penetration testing: Level 4
Maintains current knowledge of malware attacks, and other cyber security threats. Creates test cases using in-depth technical analysis of risks and typical vulnerabilities. Produces test scripts, materials and test packs to test new and existing software or services. Specifies requirements for environment, data, resources and tools. Interprets, executes and documents complex test scripts using agreed methods and standards. Records and analyses actions and results. Reviews test results and modifies tests if necessary. Provides reports on progress, anomalies, risks and issues associated with the overall project. Reports on system quality and collects metrics on test cases. Provides specialist advice to support others.
Penetration testing: Level 5
Coordinates and manages planning of penetration tests, within a defined area of business activity. Delivers objective insights into the existence of vulnerabilities, the effectiveness of defences and mitigating controls - both those already in place and those planned for future implementation. Takes responsibility for integrity of testing activities and coordinates the execution of these activities. Provides authoritative advice and guidance on the planning and execution of vulnerability tests. Defines and communicates the test strategy. Manages all test processes, and contributes to corporate security testing standards.
Penetration testing: Level 6
Takes a comprehensive approach to seeking vulnerabilities across the full spectrum of organisation policies, processes, and defences in order to improve organisational readiness, improve training for defensive practitioners, and inspect current performance levels.
Determines testing policy, and owns the supporting processes. Takes responsibility for the management of all vulnerability testing activities within the organisation. Assesses and advises on the practicality of testing process alternatives. Initiates improvements to test processes and directs their implementation. Assesses suppliers' development and testing capabilities. Manages client relationships with respect to all testing matters.
Penetration testing: Level 7
This skill is not typically observed or practiced at this level of responsibility and accountability.