Penetration testing takes place within a secure, controlled setting. It is conducted in a way that does not inflict any significant harm on the systems being tested.