Home / Knowledge hub / Manual penetration testing
Knowledge hub
Manual penetration testing
Testing led by a person's judgement, not just by running an automated scanner.
What it means
Manual penetration testing is a security test in which a person decides what to try next. They read how the application behaves, form a theory about where it might fail, and test it. Tools help with the repetitive parts, but the thinking is human. It is the opposite of a purely push-button approach.
That judgement is the difference. A scanner checks a fixed list of known problems. A person can notice that a refund flow trusts a value from the browser, then try to use it. Human testers are most useful where the rules of your business, not a known bug pattern, decide the outcome.
Why it matters
Many of the most damaging flaws are not on any list. A discount that can be applied twice, an approval step that can be skipped, a user who can edit an order after payment. They depend on what your product is meant to do, so a pattern-matching tool does not see them.
Manual work has limits too. It costs more, takes time, and depends on the tester's skill and focus. It is hard to repeat each week. That is why it is usually paired with automation, and why business-logic flaws are the classic case for human review.
How it shows up
You meet it as a scoped engagement where testers explore the app, chain small weaknesses into larger ones, and write up what they proved. The best ones start from a threat-focused view of the application: what is valuable, who could reach it, and how.
Mistakes: buying a scanner report relabelled as manual testing, a very short window for a large app, and no way to repeat the exploit afterwards. Ask what was done by hand, how findings were proved, and whether you can retest them. Compare with automated pentesting.
Questions people ask
Manual penetration testing, answered
Is manual testing better than automated?
Neither is better for everything. Manual testing is stronger at logic and chained flaws. Automated testing is stronger at coverage, speed and repetition.
Most teams get the best result by combining them.
How do I tell if a test was really manual?
Ask for the method, the time spent and the findings that were not on a scanner's list. A real report explains the steps the tester took.
If every finding is a generic known issue, be sceptical.
Why is manual testing expensive?
Skilled testers are scarce, and the work is time-based. The price reflects days of expert attention.
Narrowing the scope to the highest-risk areas keeps cost under control.
Can manual testing be repeated?
Not easily. Results depend on who tested and what they tried. A written exploit that can be replayed makes it repeatable.
Ask for reproduction steps with every finding.
Does manual testing find everything?
No test does. It finds what the tester had time and insight to try.
Coverage statements in the report, and a defined scope, tell you what was and was not examined.
Sources
Where this comes from
Related
Terms that sit next to this one
Automated penetration testing
Software that finds and proves vulnerabilities on its own, repeatably and on a schedule.
Business logic flaw
Nothing is technically broken, but your own rules turn against you.
Exploratory security testing
Unscripted testing where the tester follows hunches about how the app breaks.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Reproduction steps
The exact steps another person can follow to see a vulnerability for themselves.
Where does judgement beat a scanner?
Business-logic flaws and cross-account access need real exploitation to prove. We check both and report what we actually broke, never what only looked possible. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.