Process · Safety & Security
Penetration testing
Security testing in which testers attack a product as a real attacker would, to find weaknesses that other verification missed and to show whether its security goals hold.
- Also known as
- Penetration test, Pen test, Pentest
- Type
- Process
- Domain
- Safety & Security, Product security
Overview
Penetration testing is the validation end of security work. Where requirement-based tests check that each security function works as specified, a penetration test asks whether an attacker can still reach the assets by any route.
How it works
Testers start from the threat analysis: the assets, attack paths and attacker capabilities it assumes. They probe interfaces such as debug ports, diagnostics, wireless links and update mechanisms, try known attack techniques and look for combinations of weaknesses.
Tests may be black box, with no inside knowledge, or grey or white box, with design information, which usually finds more in the time available. Hardware tests can include fault injection and side-channel analysis on the chip itself.
Findings are rated, then fixed or accepted as residual risk, and retested. The report becomes part of the cybersecurity case, and the tests join the regression suite for later releases.
Examples
- An attempt to unlock a control unit's diagnostic services without the right key.
- Testing whether a gateway lets messages from the infotainment network reach the brakes.
- Glitching a chip's supply to try to bypass secure boot.
- A retest after a fix to an update mechanism.
Why it matters
Security evaluation engineers run it, often with an independent team or laboratory, near the end of development. On the vehicle cybersecurity lifecycle it is the main validation activity, and its results feed the cybersecurity case and type approval.
It matters most to: Hardware Security Architect, Hardware Security Evaluation Engineer, Product Security Engineer
Common confusions
- Not the same as Vulnerability scanning
- Scanning checks automatically for known weaknesses; penetration testing is a planned attack by people who combine weaknesses and look for new ones.
- Not the same as Fuzz testing
- Fuzzing feeds malformed inputs to an interface to make it fail; it is one technique a penetration test may use.
Related standards
- ISO/SAE 21434 (road vehicles, cybersecurity engineering)
- IEC 62443 (security for industrial automation and control systems)
Sources
- NIST SP 800-115 Technical Guide to Information Security Testing and Assessment (opens in a new tab), National Institute of Standards and Technology, 2026-11-10
- Penetration testing (glossary) (opens in a new tab), National Institute of Standards and Technology, Computer Security Resource Center, 2026-11-10
- Penetration testing (opens in a new tab), National Cyber Security Centre (UK), 2026-11-10
Related terms
Part of the Safety & Security glossary, with every term in the topic and the lifecycles, tools and standards that use them.
Where it appears on the Hub
Used on 9 pages of the Hub. In each group, the pages that mention it most come first.
Lifecycle stages and gates
- Cybersecurity Validation & Penetration Testing (Vehicle cybersecurity lifecycle)
- Silicon Security Evaluation (Security lifecycle)
- Cybersecurity validation complete (Vehicle cybersecurity lifecycle)
- Silicon security evaluated (Security lifecycle)
- Verification & Safety Analysis (Industrial lifecycle)
- Verification and safety analysis complete (Industrial lifecycle)
Suggest an improvement
Suggest an improvement to this entry
A clearer definition, an example, a correction or a source an editor can check. Editors review every suggestion before the entry changes.
Last reviewed . Written by The Semiconductor Hub editorial team. The full glossary