Penetration testing: what it means for a site owner

The word "pentest" often turns to fog in a conversation with an owner. Someone expects a specialist to "try to hack it". Someone expects a stamp on letterhead. The working definition is simpler. Penetration testing is an agreed check: can a person from outside, or with a customer account, do something they should not. Sign in to the admin panel, open someone else's order, call an API action without the right.

The key word is agreed. You need a contract and written permission from whoever owns the site. An address list, accounts, a work window and a ban on leaving the scope. We do not run load or destructive checks without separate consent. The frame we use is the OWASP Testing Guide and PTES. That is a frame, not a bag of tricks "for any site".

What you should get at the end

• A one or two page summary: what was confirmed and what it means for the business.
• Cards for the developer: condition, impact, how to close it. No scanner filler.
• A retest after the fixes.
• A clear view of what was not in scope. Silence about the office does not mean the office is fine.

For a landing this is often more than you need: a website security audit is enough, and for new clients it is free. For a store and an account area penetration testing is exactly the right tool. Lexora runs it remotely, from $50 per endpoint. We do not use that contract as a substitute for a compliance certificate or a license.