Penetration test
An authorised simulated attack to find exploitable vulnerabilities in applications, networks or infrastructure.
A pen test is an engagement where testers (internal or external) attempt to find exploitable vulnerabilities in a defined scope. SOC 2 does not strictly require a pen test, but most auditors expect one annually. PCI-DSS v4.0 explicitly requires internal and external pen tests at least annually and after significant change.