PTES: Penetration Testing Execution Standard
PTES (Penetration Testing Execution Standard) is a widely-used methodology that breaks a penetration test into 7 phases, pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post exploitation, and reporting, so testers and clients share a common definition of what a thorough pentest covers. Below is each phase in depth, alongside exactly how TurboPentest's agentic pentest executes it.
Pre-engagement Interactions
The phase where the tester and client agree on scope, rules of engagement, timelines, and legal authorization before any testing activity begins. It sets the boundaries the rest of the engagement must respect.
Key activities
- Define scope: which targets, networks, applications, and exclusions are in bounds
- Agree on rules of engagement: testing windows, allowed techniques, emergency contacts
- Establish legal authorization: a signed contract or letter of authorization to test
- Set goals and success criteria with the client stakeholders
- Agree on communication and escalation procedures for critical findings
How TurboPentest does this
TurboPentest replaces the scoping call with self-serve target verification: you add a domain, prove ownership (DNS, meta tag, or file), and accept the safe harbor terms in-app. There is no sales call or scoping meeting; authorization is captured the moment you verify the target and buy the pentest.
Intelligence Gathering
Reconnaissance to build a picture of the target: what infrastructure exists, what technology it runs, and what information is publicly exposed. This informs which attack paths are worth pursuing in later phases.
Key activities
- Passive reconnaissance: OSINT, DNS records, WHOIS, certificate transparency logs
- Active reconnaissance: subdomain discovery, port and service enumeration
- Technology fingerprinting: frameworks, CDNs, databases, server software and versions
- Identify the external attack surface: exposed endpoints, cloud assets, third-party services
How TurboPentest does this
Paladin AI drives subdomain discovery and port to service fingerprinting automatically: Naabu maps open ports, HTTPX fingerprints web services, and Nuclei runs service detection and version templates against everything else. The result is an attack surface map covering endpoints, open ports and services with versions, and the technology stack, delivered as part of every report.
Threat Modeling
Uses the intelligence gathered to identify the assets that matter most and the realistic threat actors and attack paths against them, so testing effort concentrates on what would actually cause damage.
Key activities
- Identify business assets and the data or functions that matter most
- Identify likely threat communities and threat actors relevant to the target
- Map attack paths from external exposure to high-value assets
- Prioritize testing focus based on likely impact, not just technical severity
How TurboPentest does this
TurboPentest produces a STRIDE threat model as a standard report deliverable: prioritized manual-testing recommendations that map the discovered attack surface to Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege categories, so you know where to focus follow-up effort.
Vulnerability Analysis
The process of discovering flaws in systems and applications that could be leveraged by an attacker. Combines automated tooling with manual verification to separate real weaknesses from noise.
Key activities
- Run vulnerability tooling against network, web application, and API surfaces
- Manually verify automated findings to rule out false positives
- Correlate discovered versions and configurations against known CVEs
- For white-box engagements, review source code for insecure patterns
How TurboPentest does this
This is the core of the automated run: 14 tools plus Paladin AI (OWASP ZAP, Nuclei, Nikto, FFUF, Naabu, OpenVAS, IntegSec PentestTools, and more) cover network, web application, API, subdomain, SSL/TLS, and external attack surface in a single pass. Connect a GitHub repo and white-box testing adds Opengrep SAST, Gitleaks secret detection, and Grype SCA against your source code, all AI-validated by Paladin so surviving findings are the ones worth reporting.
Exploitation
Gaining access to a system or application by leveraging a validated vulnerability, in a controlled way that proves impact without causing unnecessary damage.
Key activities
- Attempt controlled exploitation of validated vulnerabilities
- Avoid actions that could cause denial of service or data loss unless explicitly authorized
- Capture proof of exploitation: screenshots, request or response pairs, extracted evidence
- Document the exact steps and conditions required to reproduce the exploit
How TurboPentest does this
Paladin AI validates each candidate finding and, where safe to do so within an automated run, demonstrates impact with a proof of concept captured in the report. Every finding ships with the exact PoC and a ready-to-paste fix prompt for Cursor, Claude Code, or another AI IDE through Fix with AI, so the evidence and the remediation path travel together.
Post Exploitation
Determines the real business value of a compromised system: what an attacker could do next, such as pivoting to other systems, escalating privileges, or accessing sensitive data, and how to clean up any artifacts left behind.
Key activities
- Assess the value of the compromised system to the organization
- Identify potential pivot points to other systems or networks
- Determine what sensitive data or functionality is exposed as a result
- Clean up any test artifacts, sessions, or accounts created during testing
How TurboPentest does this
TurboPentest's fully autonomous run does not perform manual lateral movement or privilege escalation chains between systems the way a human-led post-exploitation phase does. Instead, each validated finding is classified against OWASP ASVS levels for source-code findings (and MASVS for mobile), so you understand the severity and blast radius of what was found, and Cloud EASM separately discovers and risk-scores cloud-native assets that traditional attack-surface tools miss.
Reporting
Communicates what was tested, what was found, and what to do about it, in a form both technical staff and business stakeholders can act on. The report is the primary deliverable of the entire engagement.
Key activities
- Write an executive summary for non-technical stakeholders
- Document each finding with technical detail, evidence, and business risk
- Provide remediation guidance mapped to each finding
- Provide retest steps so fixes can be verified
How TurboPentest does this
Delivered automatically within hours of the run finishing: a PDF report with executive summary, findings with proof, and remediation guidance; a signed attestation letter; the attack surface map; the STRIDE threat model; and retest commands to re-run the exact checks and confirm each fix landed. Findings are ordered by severity and pushed to Slack, email, or your CI pipeline the moment the run completes.
Frequently asked questions
What is PTES?
PTES (Penetration Testing Execution Standard) is a community-authored methodology that defines 7 phases a penetration test should cover, from pre-engagement interactions and intelligence gathering through threat modeling, vulnerability analysis, exploitation, post exploitation, and reporting. It gives testers and clients a shared baseline for what a thorough pentest includes.
Is PTES a certification or a compliance requirement?
No. PTES is a methodology, not a certification body or a regulatory standard. There is nothing to get certified in and no auditor checks a report against it. It is used as a quality baseline: a report that covers all 7 phases has demonstrably wider coverage than one that only lists vulnerability findings.
How does PTES differ from OWASP testing guides?
PTES defines the end-to-end process of a penetration test (scoping, recon, threat modeling, exploitation, reporting). OWASP's guides (the Testing Guide, ASVS, the Top 10 lists) are focused on what to test for in web, API, and mobile applications specifically. Many pentests, including TurboPentest's, use PTES-style phases as the overall structure and OWASP guidance for the vulnerability categories tested within that structure.
Does every PTES phase apply to an automated pentest?
The phases map cleanly onto an automated agentic pentest, but the depth differs from a fully manual, weeks-long engagement. TurboPentest automates pre-engagement (self-serve verification and safe harbor), intelligence gathering, vulnerability analysis, and reporting end to end, and produces a threat model and proof-of-concept evidence for validated findings. It does not perform the open-ended manual lateral movement and privilege escalation chaining of a human-led post exploitation phase.
Does TurboPentest follow PTES?
TurboPentest's agentic pentest is structured around the same 7 phases PTES defines, executed by Paladin AI orchestrating 14 tools rather than a human team working through them manually. See the phase-by-phase breakdown above for exactly how each one runs.
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Run a pentest structured around all 7 PTES phases
TurboPentest's agentic AI pentest covers intelligence gathering, vulnerability analysis, threat modeling, and reporting automatically, from $99 per target.
Start a pentest