Security analysis and pentesting

Ruslan Rakhmetov, Security Vision

One of the tasks of cybersecurity is to assess the actual security of a company's infrastructure. Without waiting for a real cyberattack, information security specialists perform security audits and pentests, using various tools to manage the attack surface and assess and prioritize vulnerabilities and threats. It is important not only to identify security gaps and promptly address them, but also to establish a security analysis and monitoring process, integrating it into the company's overall information security management system. In this article, we will discuss approaches and methodologies for security analysis and penetration testing.

Let's start with definitions:

• An attack surface is the set of possible attack vectors available to attackers on a particular infrastructure/organization.

• An attack vector is a set of methods, techniques, and tools (means) for implementing a cyberattack. A method refers to an algorithm for solving a problem, while a method refers to the actual actions required to execute that algorithm.

In addition, there are also definitions from state standards:

• The GOST R 56498-2015 standard “Security (cybersecurity) of networks and systems” states that the attack surface is the totality of system resources that are directly or indirectly exposed to the potential risk of attack.

• GOST 56939-2024, "Information Security. Development of Secure Software. General Requirements," defines an attack surface as a set of software subroutines (functions, modules) that process data received through interfaces, with these interfaces directly or indirectly exposed to the risk of cyberattack.

The attack surface should be distinguished from the threat landscape, which represents the totality of all possible cyberthreats facing a company – those that are relevant, those that are not yet relevant, and those that are unknown or unaddressed by experts. The threat landscape is constantly changing and depends on the company's security posture, its attractiveness to attackers, the situation in the country/industry, new tactics, techniques, and procedures used by attackers, and new defense and attack technologies. Thus, the attack surface is a more company-specific view of a company's security from the attackers' perspective, while the threat landscape is the environment or surroundings in which the company and its infrastructure currently exist.

Attack surfaces can be roughly divided into the following types:

• Digital attack surface is a set of digital assets (OS, software, containers, hypervisors, services, applications, accounts, etc.) that can become targets for attackers;

• Physical attack surface – a set of material assets (buildings, offices, premises, devices, printed forms of documents) that are subject to the risk of physical attack (theft, hacking, destruction, unauthorized access);

• Social engineering surface – channels and methods of psychological influence on employees, administrators, and company managers available to attackers;

• External attack surface is a collection of internet-accessible objects associated with a company (websites, APIs, ports, network interfaces, cloud services, remote connection channels and points, company social media, contact information, and publicly available documents). This digital footprint allows attackers to conduct reconnaissance, analyze the victim company's security, and even carry out a cyberattack on the company without interacting with its infrastructure – for example, by hacking a social media page and posting a compromising deepfake video featuring the company's owner. 

Security analysis and monitoring address not only the attack surface but also vulnerabilities and insecure configurations (misconfigurations). Let's review the definitions:

• A vulnerability is a weakness in an asset or control system that can be exploited by attackers to implement information security threats. A vulnerability is characterized by its severity, including the ease of exploitation and its impact on information security properties (confidentiality, integrity, availability).

In addition, there are also definitions from standards:

• The international standard ISO/IEC 27000:2018 states that a vulnerability is a weakness in an asset or control that can be exploited by an attacker.

• The Russian standard GOST R 56546-2015 states that a vulnerability is a flaw in a software or hardware tool or information system as a whole that can be exploited by an attacker (both external and internal) to implement information security threats.

Information system vulnerabilities can be caused by errors in the creation, implementation, or operation of the system, as well as by weaknesses in configurations, applied security measures, and implemented security measures. Furthermore, the Russian standard GOST R 56546-2015 identifies several possible types of vulnerabilities: code vulnerabilities, configuration vulnerabilities, architectural vulnerabilities, organizational vulnerabilities, and multifactorial vulnerabilities (a combination of other types of vulnerabilities). Thus, insecure configurations and deviations of system parameters from those recommended by the manufacturer are also a type of vulnerability. GOST R 56546-2015 also identifies potential sources of vulnerabilities: general system software, application software, specialized software, hardware, network equipment, and security measures. This standard also states that the severity of a vulnerability is a comparative value characterizing the susceptibility of an information system to a vulnerability and the impact of this vulnerability on the violation of information security properties (confidentiality, integrity, availability).

The methodological document "Methodology for assessing the criticality level of vulnerabilities in software, hardware and software", approved by the FSTEC of Russia on June 30, 2025, lists the possible consequences of exploiting (using) vulnerabilities:

• Arbitrary Code Execution

• Privilege Escalation

• Security Bypass​

• Code Injection

• Obtain Sensitive Information

• Loss of Integrity

• Denial of service (DoS)

• Overwrite Arbitrary Files

• Write Local Files

• Read Local Files

• Spoof User Interface

• Cross Site Scripting

However, it is important to understand that not all vulnerabilities are equally dangerous: the standard way of assessing them is the CVSS (Common Vulnerability Scoring System), which allows one to describe the key characteristics of a vulnerability and quantify its severity (on a scale from 0 to 10) based on the complexity of exploitation, impact on the asset's security properties, the presence of a ready-made exploit and its accessibility to an attacker, the possibility of eliminating the vulnerability (patch or workaround), the reliability level of the vulnerability report, and the specific operating environment of the vulnerable system. Not all vulnerabilities with a low CVSS score are considered low-risk and low-priority for mitigation: hackers value the availability of the vulnerable system from the internet, the possibility of exploiting the vulnerability in real infrastructure, the presence of a working exploit, and the ability to chain vulnerabilities – for example, when one exploit of a medium-severity vulnerability allows one to exploit a more dangerous vulnerability and subsequently implement the entire attack chain. Various metrics can be used to assess the severity of a vulnerability and prioritize its processing, such as:

• CISA KEV (Known Exploited Vulnerabilities) – a list of the most frequently exploited vulnerabilities according to the CISA agency;

• CISA SSVC (Stakeholder-Specific Vulnerability Categorization) – a system for categorizing vulnerabilities based on an assessment of the level of negative impact on business;

• EPSS (Exploit Prediction Scoring System) – used to assess the likelihood of exploiting a vulnerability in real attacks; machine learning methods are used for analysis.

Prioritizing dangerous configurations is more difficult, as the exploitability of a misconfiguration depends on a number of factors (system accessibility from the attacker's subnet, combination with other configurations, disabled security tools, etc.). However, there are hardening recommendations from vendors and researchers for working with misconfigurations, such as:

• NIST National Checklist Program ;

• CIS Benchmarks List ;

• Security Technical Implementation Guides ;

• Recommendations for safe installation and operation of Astra Linux;

• Microsoft Security Baselines & Compliance Toolkit ;

• Cisco Harden IOS Devices;

• Red Hat Security H ardening .

However, security analysis isn't limited to simply identifying vulnerabilities and misconfigurations. To understand the true security of an infrastructure, specialists conduct penetration testing (pentests). During these tests, ethical hackers (pentesters) simulate attacker actions, detect various attack vectors, and attempt to implement a predetermined pentest scenario – for example, gaining access to a domain controller with administrator privileges or performing a test unauthorized money transfer from an accountant's device. Pentests can be conducted using various methodologies, the main ones being:

• Methodological document "Methodology for analyzing the security of information systems", approved by the FSTEC of Russia on November 25, 2025;

• "Methodological recommendations of the Bank of Russia for conducting penetration testing and vulnerability analysis..." No. 2- MR approved by the Central Bank of the Russian Federation on January 22, 2025;

• NIST SP 800-115 Technical Publication Guide to Information Security Testing and Assessment " (Technical Guide for Information Security Testing and Assessment);

• PTES (Penetration Testing Execution Standard);

• OWASP Web Security Testing Guide (WSTG );

• OWASP Mobile Application Security (MAS );

• OWASP Firmware Security Testing Methodology (FSTM );

• PCI DSS Penetration Testing Guidance ;

• Open Source Security Testing Methodology Manual (OSSTMM ).

When conducting pentests, the following main stages are performed:

1) Agreeing on the rules and boundaries of the pentest project: specialists obtain approval from the company owning the systems being tested (these can be duplicate systems in the test environment or systems in the production segment, depending on the required level of realism of the pentest), a list of assets – pentest targets – is compiled, pentest success criteria are defined, exceptions are identified (for example, critical systems that should not be down in the event of a successful pentest), the techniques and tools that the pentesters will use are listed, and it is also decided whether SOC or information security personnel will be notified of the pentest and whether they have the right to actively counter the pentesters. Pentests can be conducted in "black-box" mode, when an external hacker attack is simulated and the attackers have no understanding of the infrastructure, or in "gray-box" mode, when an attack from an insider is simulated – an internal intruder with limited rights and fragmented knowledge of the infrastructure. In addition, during the preparation stage, an action plan is prepared in case of unpredictable consequences of the pentest (for example, the launch of an exploit led to the OS being inoperable), the time limits of the pentest are determined, the conditions for the immediate termination of the pentest are determined (for example, the start of a real hacker attack), rules for collecting evidence of a successful pentest are formed, and logging of the pentest scenario implementation procedure is configured.

2) Gathering primary information about the target: Penetrators perform reconnaissance – collecting publicly available information about the company and its employees, studying its digital footprint, searching for employee credentials in leak dumps and publicly available infostealer virus logs, analyzing the attack surface, scanning the perimeter and services used, and constructing diagrams of the interconnections of test objects accessible from the internet.

3) Building an attack plan: pentesters select and prioritize targets, prepare tools (phishing kits, vulnerability scanners, exploits, C2 servers, etc.) based on the technical input received, and plan attack vectors and routes.

4) Search and analysis of vulnerabilities and misconfigurations: Penetration testers perform automatic and manual checks of vulnerabilities and configurations, assess their exploitability, in certain cases write new or refine existing exploits, and fine-tune their tools for work in the infrastructure based on the scanning results.

5) Penetration (initial access), exploit/malware launch, persistence, privilege escalation, lateral movement: Penetrators apply the obtained information and configured tools, penetrate the tested infrastructure, develop the attack, achieve the testing objective, log the results, and document the evidence of a successful pentest. Negative impact on the system under test should be avoided, limiting the actions to pre-agreed ones. Furthermore, penetrators may detect multiple attack vectors simultaneously to achieve the same objective, as well as detect traces of compromise or signs of a real attack. In these cases, responsible personnel at the client company are notified.

6) Preparing a pentest report: A detailed description of the steps taken, the vulnerabilities and misconfigurations discovered, information about the company and employees valuable to the attackers, and objective evidence that the intended pentest objectives were achieved is compiled. The report includes a description of the potential negative impact (if real attackers were in the pentesters' place), as well as recommendations for eliminating the flaws, vulnerabilities, and misconfigurations used by the attackers, and recommendations for additional employee training in recognizing social engineering (if used in the pentest).

7) Actions following the pentest project: the ultimate goal of a pentest is to improve the cybersecurity of the client company, therefore the results of the pentest must be carefully analyzed by the information security department, attack vectors, vulnerabilities and misconfigurations must be eliminated, an analysis of the triggering of information security systems (SIEM, SOAR, UEBA, EDR, DLP systems, etc.) on the actions of pentesters must be carried out, and an assessment of the correctness and completeness of the actions performed by information security specialists upon detection of the pentest must be carried out.

The aforementioned regulatory documents of the Federal Service for Technical and Export Control of Russia and the Central Bank of the Russian Federation also outline procedures for conducting pentests, vulnerability analyses, and information system security assessments. For example, the methodological document "Methodology for Analyzing the Security of Information Systems," approved by the Federal Service for Technical and Export Control of Russia on November 25, 2025, specifies the following procedure for conducting system security assessments:

1) Collection of initial information: obtaining information about the information system, network infrastructure, users, determining the configurations of perimeter and internal network services, software, and information security tools.

2) External vulnerability analysis: detection of vulnerabilities and configuration flaws in network services (including web applications), software, and information security tools accessible from the Internet.

3) Internal vulnerability analysis: detection of vulnerabilities and configuration flaws in network services (including web applications), software, and information security tools accessible from the internal network.

4) Assessment of identified vulnerabilities: analysis of the criticality of identified vulnerabilities and misconfigurations and the possibility of implementing security threats with negative consequences, with subsequent elimination of vulnerabilities (by the customer's responsible persons) and provision of recommendations to the customer for improving the level of cybersecurity.

5) Documentation of results: pentesters generate a report that includes information about the actions taken and the results, the conditions and goals of the project, and the methods and tools used.

The following classes of information security solutions and services can be used to automate security analysis:

• EASM (External Attack Surfare Management) – a system for managing the surface of external attacks;

• CAASM (Cyber Asset Attack Surface Management) – a system for managing the attack surface of digital assets;

• BAS (Breach and Attack Simulation) – a system for simulating hacks and attacks;

• DRPS (Digital Risk Protection Services) – service protection from digital risks;

• CPT (Continuous Penetration Testing) – service conducting continuous pentest.

Security Vision products fully support security monitoring: Security Vision VS and VM products help build a vulnerability management process, while Security Vision SPC enables configuration security management. Security Vision TIP enables the integration of data on vulnerabilities, misconfigurations, and exploits used by attackers into cybersecurity processes. Security Vision SIEM and Security Vision SOAR solutions track pentesters' actions simulating hacker activity and analyze the performance of information security systems, detection logic, and response scenarios to pentesters' actions.