A penetration testing methodology is a structured, repeatable process that makes results consistent and defensible. The four that dominate work at different levels: NIST SP 800-115 is a high-level four-phase process; PTES is a detailed seven-phase execution standard; OWASP supplies deep technical checklists per target (WSTG for web, MASVS/MASTG for mobile, ASVS for verification, API Security Top 10 for APIs); OSSTMM offers a measurement-focused framework. They are complementary: quality providers run a process standard for structure and OWASP for technical coverage, mapping findings to MITRE ATT&CK. See how we apply this in our methodology.
// 01 What is a penetration testing methodology?
A methodology is the process that turns testing from an individual's improvisation into a repeatable engagement any competent tester can execute and any reviewer can audit. It defines the phases, the order, the coverage expected at each step, and the reporting standard. Without one, two testers hand you two incomparable results and neither can prove completeness. With one, coverage is demonstrable, findings are traceable, and the test stands up to an auditor.
The key distinction to hold onto: some methodologies describe how to run the engagement (process standards), and others describe exactly what to test on a given target (technical checklists). You want both.
// 02 PTES — the seven-phase execution standard
The Penetration Testing Execution Standard is the most complete end-to-end process standard, and the one most commonly used as the backbone of an engagement. It defines seven phases:
| # | Phase | What happens |
|---|---|---|
| 1 | Pre-engagement | Scope, objectives, rules of engagement, authorisation |
| 2 | Intelligence gathering | Reconnaissance and attack-surface mapping |
| 3 | Threat modelling | Identify assets and likely attack paths |
| 4 | Vulnerability analysis | Discover and validate weaknesses |
| 5 | Exploitation | Safely exploit to prove access |
| 6 | Post-exploitation | Escalate, pivot, measure real impact |
| 7 | Reporting | Prioritised findings and remediation |
PTES gives the structure; it deliberately leaves the detailed technical test cases within each phase to target-specific guides like OWASP.
// 03 OWASP — the technical checklists
Where PTES is the process, OWASP is the content — the definitive, target-specific test cases. It is not one document but a family, and you pick the right one for the asset:
WSTG
Web Security Testing Guide — the canonical checklist for web application testing: auth, session, access control, injection, business logic.
MASVS / MASTG
Mobile App Security Verification Standard and testing guide — the standard for iOS and Android testing.
ASVS
Application Security Verification Standard — defines verification levels, useful for setting the depth of a web test.
API & LLM Top 10
Target-specific risk lists for APIs and LLM applications — BOLA, mass assignment, prompt injection and more.
// 04 NIST SP 800-115 — the standards-body process
NIST SP 800-115, the Technical Guide to Information Security Testing and Assessment, is a higher-level, four-phase process: planning, discovery, attack, and reporting. It is less granular than PTES but carries the weight of a US federal standard, which is why it is frequently cited in compliance contexts and government-adjacent work (including CMMC and FedRAMP settings). Many providers use SP 800-115 as the named reference standard while executing the finer-grained PTES flow underneath.
// 05 OSSTMM and how the standards combine
The OSSTMM (Open Source Security Testing Methodology Manual) rounds out the field with a measurement-oriented approach, emphasising quantifiable "attack surface" metrics. In practice, few engagements use one methodology in isolation. A rigorous test layers them:
- Process standard (PTES or NIST SP 800-115) for the phases and structure
- OWASP guides (WSTG, MASVS, ASVS, API/LLM Top 10) for the technical test cases per target
- MITRE ATT&CK to map observed techniques to real adversary behaviour
That layering is exactly how we structure engagements — documented in our testing methodology — so every finding is traceable to a recognised standard and the coverage is auditable.
// 06 Frequently asked questions
What is a penetration testing methodology?
A structured, repeatable process governing how a test is planned, executed and reported, so results are consistent and auditable. The main ones are PTES, the OWASP guides (WSTG/MASVS/ASVS), NIST SP 800-115 and OSSTMM. A rigorous test combines a process standard with a technical checklist.
What are the phases of PTES?
Seven: pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation, and reporting. It's the most complete process standard and is usually the backbone of an engagement.
PTES vs OWASP vs NIST SP 800-115?
Different levels: NIST SP 800-115 is a high-level four-phase process; PTES is a detailed seven-phase execution standard; OWASP provides deep technical checklists per target. Process standards say how to run the engagement; OWASP says what to test.
Which methodology is best?
None alone — they're complementary. Quality providers use a process standard (PTES or NIST 800-115) for structure plus OWASP's target-specific guides for technical coverage, mapped to MITRE ATT&CK. The right mix depends on the target.
// 07 References & standards
- NIST, SP 800-115: Technical Guide to Information Security Testing and Assessment.
- Penetration Testing Execution Standard, PTES Technical Guidelines.
- OWASP, WSTG, MASVS/MASTG and ASVS.
- See our applied testing methodology.