The 5-Phase Pentesting Model, Explained Simply

If you've ever sat through a cybersecurity module and heard someone rattle off "recon, scanning, exploitation, persistence, cleanup" like it's second nature, you're not alone in wondering how those five words actually map to real work. Here's the simplified version, broken down the way I wish someone had explained it to me.

1. Reconnaissance — Gathering Info

This is the "know your target before you touch it" phase. A tester spends time collecting everything publicly available about the organization: domain records, employee names on LinkedIn, technologies mentioned in job postings, IP ranges, anything that builds a picture of the attack surface. Nothing here is intrusive yet — it's closer to research than hacking. The better this phase is done, the sharper every phase after it becomes.

2. Scanning & Enumeration — Identifying Open Ports and Services

Now the tester starts actively probing. Tools like Nmap sweep the target for live hosts, open ports, and running services, while something like Nessus flags known vulnerabilities tied to those services. Enumeration goes a step further — pulling usernames, shared folders, software versions, anything that turns "there's a server here" into "there's an outdated FTP service here, running as admin." This phase is where the target stops being abstract and becomes a map with labeled doors.

3. Gaining Access — Exploitation

This is the phase people picture when they think "hacking." Using what was found in scanning, the tester attempts to actually exploit a weakness — a misconfigured service, a known CVE, weak credentials, sometimes even social engineering — to get a foothold inside the system. The goal isn't chaos; it's proof. A successful exploit demonstrates real business risk, not just a theoretical one.

4. Maintaining Access — Post-Exploitation / Persistence

Getting in once is one thing. A real attacker wants to stay in. So testers simulate that by trying to establish persistence — backdoors, escalated privileges, lateral movement across the network — to show what a genuine intrusion could look like over time, not just in a single moment. This phase answers the client's real question: if someone got in, how much damage could they actually do before anyone noticed?

5. Covering Tracks — Clearing Logs

In a real attack, this is where the intruder erases evidence: wiping logs, hiding files, disguising traffic as normal activity. In ethical pentesting, though, this phase gets treated carefully. Testers either simulate it in a very controlled way with explicit client permission, or skip it entirely and just document everything they did instead. The point of a pentest is transparency for the client, not disappearing without a trace — so this phase is more about understanding attacker behavior than replicating it.

Why the Model Matters

None of these phases work in isolation. Recon feeds scanning, scanning feeds exploitation, exploitation feeds persistence — and the whole thing wraps up in a report that turns "we broke in" into "here's how to stop the next person who tries." That's ultimately the real deliverable of a pentest: not the access itself, but the roadmap to close the gap.