Security  ·  Buyer's Guide  ·  September 2026

What a Penetration Test
Is — and Isn't

A buyer's guide for business owners: what a real pentest involves, why an automated scan report isn't one, what you should actually receive, and the questions to ask before you pay.

---

More and more businesses in Crete are hearing they "need a pentest" — from partners, from insurers, from client requirements. Few have had anyone explain what it actually is, what you receive at the end, and how to tell a real penetration test from a PDF printed out of an automated tool. Let's put it in order.

What it is

A penetration test is a controlled, authorised attack on your systems by a professional, with your written permission and agreed boundaries. The tester tries to do what a real attacker would — get into the network, reach the data, bypass the controls — and documents exactly how they managed it, so you can close the gaps before someone with different intentions finds them.

What it is NOT

This is where the market does the most damage:

• It is not an automated scan. There are tools that sweep a network and produce an 80-page report. Useful as a first step — but if the "provider" simply hands you the tool's export with their logo on it, you didn't buy a pentest; you bought a printout.
• It is not your antivirus or firewall. Those are defences. A pentest is the check of whether the defences work.
• It is not a guarantee. No serious professional signs "you are 100% secure". A pentest shows what was found within a specific time and scope — not that nothing exists.

How it works in practice

1. Scoping: what gets tested (the e-shop? the hotel network? the Wi-Fi?), when, and what is off-limits. Signed by both sides.
2. The test: usually a few days. A good tester combines tools with manual work — the serious findings are rarely found by the tool alone.
3. The report: the real product. Every finding with a severity, evidence, and — most critically — clear remediation guidance in language both your IT person and you can understand.
4. Retest: after you fix things, the tester confirms the gaps are closed. Without this, the report remains a wish list.

When you need one

Before the season if you're in tourism; after major changes (new e-shop, new network, remote work); if you handle cards or sensitive data (clinics, accounting firms); or when contracts and insurers require it. For most SMBs, once a year plus a retest is a realistic rhythm.

What to ask before you pay

• "Can I see a sample report?" (anonymised — if they don't have one, walk away)
• "Is a retest included in the price?"
• "What will you do manually, and what with tools?"
• "Do we sign an NDA and a written scope before you start?"
• "What's your background — certifications, profiles, previous engagements?"

Red flags: promises of "absolute security", a price quoted without a single question about your environment, refusal to share a sample report, and "tests" that finish within the hour.