Penetration testing aims to discover and verify the exploitability of an information system's vulnerabilities by simulating real attacks, from outside or inside the system. Used alongside other audits, it combines tools, processes and manual expertise. The tests, part of a continuous improvement approach, identify the main vulnerabilities, provide recommendations and propose an action plan. Carried out as black-box, grey-box or white-box tests, they assess different levels of access and exposure. During the testing period, permanent contact is maintained with the audited party, including kickoff meetings, daily check-ins, findings debriefs and delivery of detailed reports with recommendations.