Home / Knowledge hub / PTES
Knowledge hub
PTES
A standard outline of the phases of a penetration test.
What it means
PTES stands for the Penetration Testing Execution Standard. It is a community-written outline of how a penetration test is carried out, from first conversation to final report. It is a guide to structure and vocabulary, not a certification or a legal standard. It was written by practitioners and first published around 2009.
It names seven phases: pre-engagement interactions, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post exploitation and reporting. Each has technical guidelines that testers can follow. The guidelines are public, so any buyer can read what each phase involves and hold a provider to it.
Why it matters
A shared outline makes tests easier to compare and easier to buy. If a provider says their method follows PTES, you can ask what they do in each phase and what you will receive. It also helps new testers work to a consistent pattern rather than inventing one.
For buyers it is a checklist for questions. Did they agree the scope first? Did they model threats for your application, or just run tools? Was exploitation limited to what the rules allowed? A report should reflect all of the phases, not just a list of findings.
How it shows up
You meet PTES in provider proposals and in training courses. In practice, the early phases agree scope, goals and rules of engagement. Middle phases map the target, find weaknesses and try to exploit them. The last phase turns this into a report with an executive summary and technical detail.
The standard is general and was written mainly with networks in mind, so for web applications and APIs it is usually combined with the OWASP testing guide. Mistakes: treating the name as a quality mark, and skipping threat modelling. Ask for real examples of each phase.
Questions people ask
PTES, answered
Is PTES an official standard?
It is a community standard, not one issued by a government or standards body. It is widely referenced but not mandatory.
Treat it as a helpful structure rather than a certification.
What are the seven phases?
Pre-engagement interactions, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post exploitation, and reporting.
Together they take a test from agreement to deliverable. Intelligence gathering is the second phase and reporting the last.
Does PTES cover web applications?
Only in a general way. For web apps and APIs, testers usually add the OWASP Web Security Testing Guide, which goes into application-specific checks.
Ask which guides a provider uses. Application-level checks sit outside its scope.
How is PTES different from OWASP's guide?
PTES describes the overall process of an engagement. The OWASP guide describes what to test in a web application.
Many testers use both together. Use the pair to cover both process and detail.
Does following PTES guarantee a good test?
No. A provider can claim PTES and still deliver a thin result. The phases tell you what to ask about, not how well it was done.
Look at the report and the evidence.
Sources
Where this comes from
Related
Terms that sit next to this one
OSSTMM
A methodology for measuring operational security through repeatable tests.
Penetration test scope
The written list of what a pentest may and may not touch.
Rules of engagement
The agreed limits, times and contacts that govern how a security test is run.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Threat model
Asking what is worth taking, who wants it, and how they would try.
What does each phase leave you with?
Our reports carry the request, the response, a screenshot where a person can see it, and the line of code, because we report only what we actually exploited. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.