Career Paper: Penetration Testing

Career Paper: Penetration Testing

Gary Hensley

August 9, 2026

Old Dominion University

CYSE201S Cybersecurity and the Social Sciences

Professor Matthew Umphlet

Penetration testers perform ethical hacking as a form of auditing a system to report software weaknesses. Pen testers don’t only need to have technical skills but also critical thinking and social science skills. The Bureau of Labor Statistics places penetration testing in the duties of information security analysts and projects a 35% increase in demand by 2031 (CyberDegrees.org Staff, 2023).

As the reliance on technology has grown and is tied to all forms of economic and social life, the need for cybersecurity and more confidence in systems has grown. Pen testers, either from an outside firm or internal, use ethical hacking to test security systems and policies to generate a report to help resolve issues before a real attack. Some skills needed for a pen tester are a desire to learn to keep up with changing technology, teamwork oriented, strong verbal communication to share findings clearly with less technical knowledge, and writing skills to create professional reports of findings (CyberDegrees.org Staff, 2023). In the journal review, a systematic literature review on penetration testing in networks aims to show awareness and improvement of network penetration testing for organizations that may fall victim due to their employees (Alhamed & Rahman, 2023). So, a pen tester needs to have knowledge of human behavior and how it might allow for weaknesses in the system. A tester will have many tools and different methods of looking for vulnerabilities. Three main types are black box, white box, and gray box (Alhamed & Rahman, 2023). The black box is more realistic, and there is no knowledge of the system going in and no access.  White box the tester has full knowledge of the system and access is open. Gray box is a mix of both black and white. When testing systems, they will be simulating cyber attacks and tend to use similar methods illegal hackers would. This may include using social engineering on employees or phishing emails to gain access. Working as an ethical hacker and using social engineering or phishing emails, the pen tester should refrain from stereotyping or targeting certain groups of employees. Knowing company culture and that the human aspect is a big weakness helps them recommend policy changes and training recommendations. Another aspect of being an ethical hacker is criminology. Having the knowledge of cybercriminals helps a pen tester simulate realistic attacks and gives you possible attacks a company might see. One of the big parts of a pen tester is reports. A report is created for everything found in testing and recommendations. You must be able to generate a professional and technical report and still be able to explain to a person with less technical skills.

In the field of a pen tester (ethical hacker), this could be a firm that is hired from the outside or an internal company job. The field is greatly tied to social sciences. Having knowledge of human psychology and social behaviors to help find weaknesses. The Knowledge of criminal hackers to help with the building of realistic attacks or know what they look for when setting up attacks. In the fast-changing world of the cyber world, it is important to keep up with new and changing attacks. The field follows standards of ethical conduct and requirements. The job requires more than just technical skills but a well-rounded knowledge of people, social dynamics, company culture, and criminals minds.  

References

, M., & Rahman, M. M. H. (2023). A Systematic Literature Review on Penetration Testing in Networks: Future Research Directions. Applied Sciences, 13(12), 6986. https://doi.org/10.3390/app13126986

CyberDegrees.org Staff. (2023, January 20). Penetration tester career overview. CyberDegrees.org. https://www.cyberdegrees.org/jobs/penetration-tester

IJSRCSEIT, I. J. of S. R. in C. S. E. and I. T. (2021). Ethical Hacking : Roles, Phases and Impact on various sectors of the Economy. International Journal of Scientific Research in Computer Science, Engineering and Information Technology. https://doi.org/10.32628/CSEIT21765