PTES.

A community-built penetration testing methodology organizing engagements into seven phases from pre-engagement scoping through reporting and remediation guidance. It belongs to the Compliance & Frameworks category of cybersecurity.

A community-built penetration testing methodology organizing engagements into seven phases from pre-engagement scoping through reporting and remediation guidance.

The Penetration Testing Execution Standard (PTES) is a community-maintained framework that defines how a professional penetration test should be planned, executed, and reported. It organizes work into seven phases: Pre-engagement Interactions, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post-Exploitation, and Reporting. PTES is paired with a Technical Guidelines document that recommends specific tools and tactics for each phase. It is widely adopted by consulting firms and internal red teams because it standardizes scope, rules of engagement, and deliverables across diverse environments, and aligns well with related frameworks such as OSSTMM, NIST SP 800-115, and OWASP testing guides.

Defences for PTES typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Penetration Testing Execution Standard.