Ethical Hacking and Penetration Testing in Modern Cybersecurity: A Review of Methods, Value and Emerging Challenges

Penetration testing is the authorised simulation of a cyber-attack to find and exploit weaknesses before real attackers do. It differs from vulnerability assessment because it shows whether a flaw can actually be exploited and what an attacker could reach through it. This narrative review examines the role of penetration testing in organisational security, drawing on testing standards, regulations, industry reports and peer-reviewed studies. The paper makes three contributions. First, it maps the seven phases of the Penetration Testing Execution Standard (PTES) onto the four phases of NIST SP 800-115, showing how tactical testing steps fit inside an auditable governance process. Second, it reviews how penetration testing supports risk prioritisation, the business case for security spending, and compliance with PCI DSS, the EU GDPR, the Digital Operational Resilience Act (DORA) and the NIS2 Directive. Third, it discusses four pressures changing the practice: cloud misconfiguration, the limits of point-in-time testing, large language models used by both attackers and testers, and the growth of red teaming and adversary emulation. The review finds that penetration testing remains necessary because automated scanning does not reliably reproduce how human attackers chain weaknesses together, but the practice must become more continuous and better combined with automation. It closes with three directions for future research: validated AI-assisted testing tools, shared measures for adversary emulation, and governance rules for continuous automated testing. This is a preprint (Version 1, October 2026) and has not been peer reviewed.