Glossary · Testing & Security

Penetration Testing

A controlled, authorised simulation of a real-world attack in which a tester actively attempts to exploit weaknesses to gauge their real impact. Unlike an automated scan, it adds manual exploitation and business-logic testing to show what an attacker could actually achieve.

This definition is part of TCSA’s plain-English compliance glossary, written and reviewed by the auditors who prepare organizations for these frameworks — 500+ audits delivered across India, USA, UK, Australia & UAE.

Go deeper: the full Penetration Testing guide

The complete plain-English explainer behind this definition.

Related Testing & Security terms

CERT-In

India's national agency for responding to cybersecurity incidents, operating under the Ministry of Electronics and IT. Its 2022 directions set mandatory incident-reporting timelines and log-retention rules, and certain audits are expected to be performed by CERT-In empanelled assessors.

PCI DSS

A security standard maintained by the PCI Security Standards Council that applies to any organisation storing, processing, or transmitting payment-card data. It defines technical and operational requirements, with the validation method depending on transaction volume.

RBI Cybersecurity Framework

A set of cybersecurity directions issued by the Reserve Bank of India for banks, NBFCs, and other regulated entities, covering governance, controls, incident reporting, and resilience. The depth of expected controls scales with the size and risk profile of the institution.

VAPT

A combined security exercise that pairs broad automated vulnerability scanning with targeted manual penetration testing. The assessment finds and catalogues weaknesses, while the penetration test verifies which ones are genuinely exploitable.

Browse all 54 glossary terms