External testing to attempt to compromise critical IT systems
Simulate the motives and techniques of an attacker
Conduct internal testing to evaluate the risk from staff and partners
Attempt to escalate privileges from a standard user account
Conduct testing of service providers to validate their protection systems