# How to Become a Penetration Tester
Penetration testing is the practice of simulating adversarial attacks against an organization's systems, networks, and applications with explicit authorization, for the purpose of identifying vulnerabilities before real attackers find them. A penetration tester, often called a pen tester or ethical hacker, is the professional who executes those simulations, documents findings, and translates technical weaknesses into business risk.
The role sits at the offensive end of the cybersecurity spectrum. Where defenders build and maintain controls, pen testers probe those controls to find gaps. The work spans a wide range of attack surfaces: internal networks, external-facing web applications, wireless environments, physical access controls, social engineering scenarios, and cloud infrastructure.
Penetration testing is not the same as vulnerability scanning. A scanner runs automated checks and produces a list of potential issues. A pen tester uses a combination of automated tools and manual techniques to chain vulnerabilities together, demonstrate real-world impact, and distinguish a theoretical weakness from an exploitable attack path. That distinction is what organizations pay premium rates for.
Within the Planetary Defense Model, penetration testing is the operational practice of the VSD (Vulnerability and Surface Defense) domain. VSD governs everything visible to an attacker: ports, protocols, services, code, configurations, and credentials. CDA's methodology for VSD is Continuous Surface Reduction (CSR), with the tagline: "Every surface you expose is a surface we eliminate." Penetration testing is how CSR measures the real-world effectiveness of surface reduction efforts.
The path into penetration testing follows a recognizable sequence, though not everyone enters from the same starting point.
Before touching offensive tooling, you need a solid understanding of how systems and networks function legitimately. This is non-negotiable. Pen testers who skip fundamentals hit a ceiling quickly because they cannot reason about why an attack works, only that it does.
The core knowledge areas are:
Networking fundamentals. Understand the OSI model, TCP/IP, DNS, HTTP/HTTPS, SMTP, and common protocols at the packet level. Know how routing works, what a subnet is, and how traffic flows across a network. Tools like Wireshark become significantly more useful once you can read what you are looking at without guessing.
Operating system internals. Windows and Linux are both required. On Windows, understand Active Directory structure, Group Policy, the registry, local security authority (LSA), and how authentication works via NTLM and Kerberos. On Linux, understand file permissions, process management, the sudo model, and where credentials and configuration files live. Most real-world environments are hybrid, so comfort with both is expected.
Web application security. The OWASP Top 10 is the baseline curriculum. Understand SQL injection, cross-site scripting (XSS), insecure direct object references (IDOR), broken authentication, server-side request forgery (SSRF), and XML external entity (XXE) injection. Web applications are the most common target in modern assessments, and web-specific vulnerabilities account for a disproportionate share of critical findings.
Scripting and automation. Python is the primary language for pen testers. You need to write custom scripts, modify public exploits, automate repetitive tasks, and parse tool output. Bash is essential for Linux-based work and is often the shell available after gaining initial access. PowerShell is required for Windows post-exploitation. You do not need to be a software engineer, but you must be able to read and write functional code in all three.
You cannot become a penetration tester by reading about it. Hands-on practice is mandatory. The home lab is where that practice happens before you touch a client environment.
The most valuable lab you can build is an Active Directory (AD) environment. AD is present in the vast majority of enterprise environments, and AD attacks (Kerberoasting, Pass-the-Hash, DCSync, LLMNR/NBT-NS poisoning, bloodhound path analysis) appear in nearly every internal network assessment. A basic AD lab requires three virtual machines: a Windows Server domain controller, one Windows workstation joined to the domain, and a Kali Linux attacker machine. This can run on a single laptop using free hypervisors.
Beyond the home lab, use structured practice platforms. HackTheBox (HTB) and TryHackMe (THM) provide legal, intentionally vulnerable machines and guided learning paths. Proving Grounds Practice (PG Practice) from Offensive Security uses the same retired machines referenced in OSCP preparation and is one of the most targeted practice environments available. Participating in Capture the Flag (CTF) competitions builds problem-solving speed and exposes you to attack categories you would not encounter in routine lab work.
Certifications serve two purposes: they validate your skills to employers, and they provide structured curriculum that fills gaps a self-directed learner can miss.
OSCP (Offensive Security Certified Professional) is the gold standard for entry-level to mid-level pen testers. The exam is 24 hours of hands-on exploitation across a network of machines, followed by a 24-hour report window. There are no multiple choice questions. You either compromise the machines or you do not. Employers treat an OSCP as a verified signal that the candidate can operate under pressure and produce professional deliverables. The associated course, PEN-200, is the most widely respected pen testing curriculum available.
PNPT (Practical Network Penetration Tester) from TCM Security is practical, affordable, and increasingly respected. It emphasizes Active Directory attacks and report writing in a format closer to a real engagement than the OSCP exam. It is an excellent first certification for those who find the OSCP cost prohibitive or want a more realistic assessment scenario.
GPEN (GIAC Penetration Tester) is the GIAC equivalent of OSCP, with open-book format but rigorous coverage of penetration testing methodology. GIAC certifications are widely recognized in government and defense contractor environments.
CEH (Certified Ethical Hacker) is a multiple-choice exam that provides broad coverage at a surface level. It is widely recognized for HR filtering purposes but does not demonstrate hands-on skill the way OSCP or PNPT does. It is most useful as a resume line for organizations that require it by name.
eCPPT (eLearnSecurity Certified Professional Penetration Tester) is a practical exam from INE/eLearnSecurity that covers web application and network penetration testing. It sits between CEH and OSCP in difficulty and is a reasonable stepping stone.
Professional pen testers use a combination of purpose-built tools and general-purpose scripting. Kali Linux ships most of what you need.
Nmap is the standard port scanner and service fingerprinting tool. Every engagement starts with it. Learn the output formats, understand NSE scripting, and know what each scan type does at the network level.
Burp Suite is the primary tool for web application testing. The Community edition is functional for learning; professional engagements use the Pro edition for its scanner and advanced features.
Metasploit Framework is the most widely used exploitation framework. Understand how to select modules, configure payloads, and manage sessions. Equally important: know when not to use it, because many mature organizations detect Metasploit signatures.
BloodHound maps Active Directory attack paths by analyzing relationships between users, groups, computers, and trusts. It visualizes paths to domain admin that would take hours to find manually. Learning BloodHound output is required for any internal network assessment.
Cobalt Strike is the commercial command-and-control (C2) framework used by red teams and, unfortunately, threat actors. It appears in real-world malware because it is effective. Understanding its capabilities and how defenders detect its signatures is important both for offensive operators and for understanding what real threat actors use.
Organizations spend billions on security controls annually. Penetration testing is the mechanism that validates whether those controls actually work under realistic attack conditions.
A firewall rule that looks correct in a spreadsheet may have been misconfigured during implementation. An IAM policy that appears locked down may have an overly permissive role attached to a service account. An application that passed a static code analysis scan may still contain a business logic flaw that only becomes visible when a human attacker reasons about the workflow. Automated scanning catches known vulnerability signatures; penetration testing finds the gaps that automation cannot.
The business case is clear: a finding discovered by a pen tester during a controlled engagement costs a fraction of what the same vulnerability costs when exploited by an adversary. The average cost of a data breach globally is now well above $4 million, according to IBM and Ponemon Institute research. A single penetration test that surfaces a critical finding and prevents a breach pays for itself many times over.
From a regulatory standpoint, many frameworks require regular penetration testing. PCI DSS requires annual external penetration testing and testing after significant infrastructure changes. HIPAA guidance strongly recommends it. FedRAMP mandates it for cloud service providers serving federal agencies. SOC 2 Type II auditors look for evidence of regular testing.
For individual practitioners, the skills are among the most transferable in cybersecurity. A pen tester who understands how attacks work is a significantly more effective defender, threat hunter, or incident responder. The offensive mindset, specifically the habit of asking "how would I break this?" before asking "is this configured correctly?", sharpens every other security discipline it touches.
The full skills map for a penetration tester, organized by progression level:
Entry level: Networking fundamentals, Linux command line, Windows basics, OWASP Top 10, Python scripting, Nmap, Burp Suite Community. Certifications: CompTIA Security+, CompTIA PenTest+, PNPT, CEH.
Mid level: Active Directory attack paths, Metasploit, BloodHound, Covenant or Sliver C2 (open-source alternatives to Cobalt Strike), post-exploitation tradecraft, privilege escalation (Windows and Linux), report writing. Certifications: OSCP, GPEN, eCPPT.
Senior level: Custom exploit development, advanced evasion techniques, cloud penetration testing (AWS, Azure, GCP), mobile application testing, thick client testing, physical security assessments, adversary simulation. Certifications: OSED (Offensive Security Exploit Developer), OSEP (Offensive Security Experienced Penetration Tester), CRTO (Certified Red Team Operator).
Career ladder: Junior Penetration Tester, Penetration Tester, Senior Penetration Tester, Lead/Manager, Red Team Lead, Offensive Security Director. Salary ranges vary significantly by geography and sector. In the United States, entry-level roles start around $70,000 to $90,000, mid-level practitioners earn $100,000 to $140,000, senior and lead roles reach $150,000 to $180,000, and offensive security directors at mature organizations can exceed $200,000. Government and defense contractor roles often add clearance premiums.
Specializations within the field include red team operator (sustained adversary simulation), web application tester, mobile application tester, cloud security assessor, hardware and firmware tester, and social engineering specialist. Each specialization has its own additional skill requirements and corresponding premium in the market.
Penetration testing lives inside the VSD domain of the Planetary Defense Model, the ocean layer of the planetary metaphor. VSD governs everything on the surface, everything visible and reachable from an attacker's vantage point. The methodology is Continuous Surface Reduction (CSR): "Every surface you expose is a surface we eliminate."
CSR does not treat penetration testing as a one-time audit checkbox. It treats it as an ongoing operational input to surface management. Every finding from a penetration test feeds back into the reduction process: patch the vulnerability, reconfigure the service, eliminate the unnecessary exposure. Then test again. The surface shrinks over time as a function of deliberate, evidence-based decisions.
This approach differs from how most organizations use penetration testing. The conventional model is annual testing for compliance, findings get filed in a report, some high-severity items get patched before the auditor returns, and the organization repeats the cycle. CSR breaks that cycle by treating the pen test output as operational data, not compliance documentation.
CDA.Institute offers VSD-domain certification paths that include hands-on penetration testing curriculum. The coursework maps directly to CSR methodology and prepares practitioners to execute assessments that produce actionable surface reduction intelligence, not just findings lists.
CDArmy deploys vetted penetration testing practitioners on VSD missions. The relevant missions for pen testers are VSD-D01 through VSD-D04, which cover external network assessment, web application assessment, internal network assessment, and Active Directory-specific operations respectively. CDArmy members executing these missions build verifiable operational history that advances their clearance level within the CDA ecosystem.
The Shield, CDA's circular diagnostic visualization, shows the VSD ring as the ocean layer surrounding the geological core. When a pen test reveals a critical finding in VSD, the Shield reflects that as a breach in the ocean layer, with potential cascade risk to DPS (the core). That visual framing is useful in executive briefings: a vulnerable perimeter is not just a technical problem, it is a gap in the layer that protects everything else.