PTES — The Seven Phases of the Pentest
Scope and purpose
The Manual requires offensive validation (pentest) for L2/L3 systems and critical products, but without defining the depth that distinguishes a serious pentest from a rebranded scan. The PTES (Penetration Testing Execution Standard) provides that reference: seven phases that structure what a pentest must cover, from framing to report.
This addon integrates PTES as the methodological reference that anchors the already existing pentest requirement. It does not impose it as the sole standard — OSSTMM, NIST SP 800-115 and the OWASP WSTG are valid complementary references depending on the scope.
Applicability: L2 and L3, external APIs and critical products, in accordance with the pentesting policy.
PTES is a reference of method, not a certification. The depth applied in each phase must be proportional to the risk of the system. Exploitation and post-exploitation require explicit authorisation and documented rules of engagement — the methodology does not dispense with the legal framing.
The seven phases
- Pre-Engagement. Definition of scope, rules of engagement, formal authorisation and objectives (black-box, grey-box, white-box). It is the phase that makes the pentest legal and bounded; without it, execution is risk exposure, not validation.
- Intelligence Gathering. Collection of information about the target — exposed surface, technology, OSINT — to identify the entry points that a real attacker would exploit.
- Threat Modelling. Identification of the assets, business processes and relevant threat communities, to focus the effort where the impact is greatest. This phase must reuse the system's threat model (Ch. 03), not start again from scratch.
- Vulnerability Analysis. Identification of the exploitable weaknesses at the mapped entry points, combining tooling and manual analysis.
- Exploitation. Confirmation of real exploitability, not merely theoretical. It is what separates the pentest from vulnerability analysis: it demonstrates that the weakness is actionable, within the rules of engagement.
- Post-Exploitation. Assessment of the impact achievable after compromise — lateral movement, privilege escalation, access to data, persistence. It quantifies the business risk and is strictly bounded by the rules of engagement.
- Reporting. Documentation of findings, evidence, risk classification and remediation guidance, addressed to decision-makers as well as to technical teams. The report is the product of the pentest; without it, the exercise produces no actionable value.
Integration into the testing programme
Each PTES phase is anchored in artefacts already defined in SbD-ToE:
- Pre-Engagement materialises in the pentesting policy and in the formal authorisation — scope, periodicity and rules of engagement.
- Threat Modelling reuses Ch. 03, avoiding duplication and ensuring coherence between what was modelled and what is tested.
- Reporting feeds findings management (Ch. 10) and demands the same discipline of evidence and reproducibility applied to any test — a pentest finding that is not reproducible is not actionable.
Relation to TLPT
PTES defines the depth of a general pentest, proportional to risk. TLPT (Threat-Led Penetration Testing) is a distinct regulatory regime under DORA, with its own requirements on scope, threat intelligence and supervision. The two are not to be confused: applying PTES does not satisfy a TLPT obligation, and TLPT does not dispense with the regular practice of risk-proportional pentest.
Cross-references
| Document | Relation |
|---|---|
| Ch. 10 — PenTesting | Offensive validation requirement that these phases deepen |
| Ch. 10 — Findings management | Destination of the findings of the Reporting phase |
| Ch. 10 — Evidence and reproducibility | Evidence discipline applicable to pentest findings |
| Ch. 10 — TLPT readiness | Distinct regulatory regime, not to be confused with general pentest |
| Ch. 03 — Threat Modelling | Model reused in the Threat Modelling phase of PTES |
| PenTesting Execution Policy | Framing, scope and periodicity |
About the curation: Consolidated from PTES (Penetration Testing Execution Standard, pentest-standard.org) and complementary references (NIST SP 800-115, OSSTMM). A methodological reference proportional to risk — neither a certification nor a substitute for regulatory TLPT.