Developing an overall flow or life cycle for your ethical hacking event arms you with a solid and meaningful plan of attack. Without a solid and meaningful plan of attack, your pen test may return results that look like some sort of random scan. And you probably don’t want to perform a simulation of an attack with no meaningful data to show for it.  Here is just one lifecycle example that may work for your penetration test: Discovery and Reconnaissance.  During this recon phase, you get the chance learn everything possible about your organization, within the defined scope of the specific pen test. Learn more about personnel, online services, systems and more. Here, you might discover and neutralize a vulnerability that could provide important information via the public domain that can boost an attacker’s efforts. Scanning and Probing.  Here, your tester will simultaneously run both a manual and automated process to identify vulnerabilities. The automated and manual testing should run parallel, yielding the same results in real-time.  Exploitation.  Once the tester has identified an issue, he or she will try to exploit it. The most experienced testers will eschew tools to get around obstacles like antivirus software. The process in this scenario requires testers to creatively and earnestly compromise confidentiality, integrity and, at times, availability of a system.  Post-Exploitation.  When your tester has exploited a vulnerability, he or she will use that access or information to gain additional access to the resource or system. At that point, the cycle repeats.