A major advantage to performing a pen test in your production environment is that you are seeing what happens under actual conditions while using your website, website application or API, using the latest developments that your team has updated. The only small possible downside to live pen testing during production is that it may interfere with normal operations. The solution to this potential problem is running your test in an ISO-production environment that is identical to your production environment. With this approach, you still get the value of a true simulation without the risk to your live environment.  Performing a penetration test in a pre-production environment is not all that different from performing it in the production environment. One key variation is that this test has no chance of touching services accessed by your users or customers. A pre-production penetration test is ideal for reviewing critical infrastructure integrity.