Safety Center

How to Become a Penetration Tester

Penetration testing is the most glamorous job in cybersecurity — and one of the hardest to enter directly. This guide is honest about that: what the job actually takes, why junior roles are scarce, and the route that really gets people in.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

What a penetration tester actually does

A penetration tester — often called a pentester or ethical hacker — is hired to break into systems on purpose, with permission, so the owner can fix the weaknesses before a criminal finds them. A typical engagement has four phases: scoping and rules of engagement (what you may test, what is off-limits, when you may test), reconnaissance and vulnerability discovery, careful exploitation to prove a weakness is real, and reporting — a clear, prioritised report the client can act on, plus a debrief.

Reporting is at least half the job. A test that finds ten weaknesses and explains none of them clearly is useless. Clients pay for the report: what is wrong, how bad it is, how it was proven, and how to fix it. Testers who write well, explain risk in business terms, and give practical fixes are the ones who get hired again. The glamorous part — finding the flaw — is real, but it sits inside a disciplined, documented, client-facing job.

The destination-role honesty

Here is the part most guides bury: junior penetration-testing roles are scarce. Employers hiring a tester are trusting that person with access to their live systems and their most sensitive data. They want evidence of judgement, not just tool knowledge — the judgement to stop when something is out of scope, to avoid breaking a production system, and to handle sensitive data properly. That judgement is hard to prove without experience, which is why most testers arrive via a neighbouring role.

The honest route looks like this: start in a SOC, in systems or network administration, or in software development; build testing skills in labs alongside that job; collect authorised evidence (lab write-ups, competition results, responsible disclosures through proper channels); then apply for junior tester roles with a portfolio that proves both skill and judgement. Some people do enter directly — usually through a structured junior programme at a consultancy — but they are the exception, and planning as if you will be the exception is a slow way to get a job.

Skills that actually count

• Networking and operating systems, deeply: not just definitions — how services behave, how Active Directory works, how Linux systems are administered. Testers live in these systems.
• Web application fundamentals: how HTTP works, sessions, authentication, common weakness classes at concept level (injection, broken access control, misconfiguration). The OWASP Top 10 is the standard map — learn it as a vocabulary, not a checklist.
• Scripting: enough Python or Bash to automate repetitive work, parse output and adapt tools. You do not need to be a developer, but you need to read and write small scripts confidently.
• Method over tools: tools change; method does not. Employers test whether you can explain why you tried something, what it proved, and what you did next — not whether you can name twenty tools.
• Writing: clear, structured, honest reports. A finding you cannot explain is a finding you cannot sell.

You will also hear about specific tools in every guide. Learn the concepts they embody and practise with the standard lab tooling — a web proxy for inspecting traffic, a network scanner for authorised lab networks, and the practice platforms below — but do not collect tool names as a substitute for understanding.

Where to practise — legally

All practice happens in authorised environments. The standard beginner platforms are HackTheBox and TryHackMe, which provide legal lab machines to practise on, and PortSwigger Web Security Academy, which offers free, legal web-security labs with detailed explanations. Capture-the-flag competitions are also excellent: they teach method, persistence and teamwork under time pressure.

A second, stronger form of evidence is responsible disclosure through a public vulnerability disclosure programme: find a weakness in a system whose owner invites reports, follow their rules exactly, and report it privately. That is the bridge between lab practice and real work — and it is covered in detail in our bug bounty guide and the vulnerability report template.

Certifications, in order

Start with a broad foundation — CompTIA Security+ is the usual first step. Then move to practical testing certifications that require hands-on demonstration in a lab environment. The best-known practical routes are associated with the major training providers in offensive security; choose based on what employers in your market ask for, and favour certifications that make you prove skills rather than only answer questions. A practical certificate plus a portfolio of written lab reports beats a longer list of theory-only certificates every time.

Do not publish or rely on exam fees from this page: fees and exam versions change, and sources conflict. Check the current fee and syllabus on the issuer's own website before booking. Last checked: 14 November 2026.

Building proof: the portfolio testers need

A tester portfolio is different from a general security portfolio. It should show method: pick three lab machines or web labs you completed, and write each one up as a short professional report — scope, method, findings with evidence, risk rating with reasoning, and remediation advice. Include one finding you investigated and decided was not a vulnerability, with your reasoning: that demonstrates judgement, which is exactly what employers are screening for. Never include real client data, real credentials, exploit code aimed at live targets, or anything tested without permission. Full rules are in our portfolio guide.

What to do this month

If you are starting from zero: get into IT support or a SOC role first, and start lab practice in parallel — two or three evenings a week on a legal practice platform, writing up everything you do. If you already work in IT: pick one lab platform, complete its beginner path, write up three machines properly, and apply for junior tester roles at consultancies that run structured junior programmes. If you are a developer: learn web-application testing deeply, because your code knowledge is a genuine advantage in application testing. In every case, the order is the same: neighbouring job, lab evidence, written proof, then the tester role.

Sources

• OWASP Top 10 — web application security risks
• PortSwigger Web Security Academy — free legal web security labs
• Research methodology — how this guide was researched
• CompTIA Security+ — issuer information

Last checked: 14 November 2026

Frequently asked questions

Can I become a penetration tester with no experience?

Directly, very rarely. Employers hiring junior testers usually want adjacent experience — SOC work, systems or network administration, or development — plus strong lab evidence. Treat penetration testing as a destination role reached through a neighbouring job, not as a first job.

Do you need a degree to become a penetration tester?

No. Employers care about demonstrated skill: lab write-ups, capture-the-flag results, authorised bounty work and certifications. A degree can help but is not required, and it does not substitute for hands-on evidence.

How long does it take to become a penetration tester?

There is no single timeline. Published guides commonly describe 12–24 months of focused preparation for someone starting from an adjacent IT role, and longer from zero. Judge readiness by what you can demonstrate in a lab, not by months passed.

What is the difference between penetration testing and bug bounty hunting?

Penetration testing is a formal, contracted engagement: a client hires you to test defined systems in a defined window and you deliver a report. Bug bounty hunting is finding vulnerabilities in public programmes for rewards, on the programme's terms. Bounty work is good practice; it is not the same job.

Which certification should a penetration tester get first?

Start broad — CompTIA Security+ — then move to a practical, hands-on testing certification such as the ones offered by the major practical training providers. Employers value certifications that require demonstrating skills in a lab over those that only test multiple-choice knowledge.

Is penetration testing legal?

Only with permission. Testing a system without the owner's written authorisation is unlawful in many countries, even if your intentions are good. All learning happens in labs, on your own systems, or through authorised programmes.