'Penetration testing' is:

Penetration testing phases:  1) Reconnaissance (passive/active information gathering — OSINT, network scanning).  2) Scanning/Enumeration (identifying open ports, services, vulnerabilities — Nmap, Nessus).  3) Exploitation (gaining access — Metasploit, custom exploits). 4) Post-exploitation/Maintaining Access (privilege escalation, lateral movement, persistence).  5) Reporting (documenting findings, CVSS scores, remediation recommendations). RBI mandates annual VAPT by CERT-In empanelled agencies for all banks. Types: Black box, White box, Grey box.