A simulated cyberattack carried out by authorised professionals to identify vulnerabilities in an organisation’s systems, networks, or applications before malicious actors can exploit them.