A penetration test is an authorized, simulated attack on your network carried out by security professionals using the same techniques real attackers use — probing for weaknesses, then actually attempting to exploit them to see how far they can get.

Manufacturers need it because a modern facility isn't just an office network — it's office IT connected, directly or indirectly, to production equipment, ERP systems, and often third-party vendor access. A pen test is the only way to see how those connections actually behave under attack, rather than assuming the diagram in your documentation matches reality.

CMMC Level 2 doesn't have a single control literally labeled "penetration test." What it does require is regular vulnerability scanning and periodic testing of your security controls to confirm they're operating as intended — the Assessment, Authorization, and Monitoring practices built into NIST SP 800-171.

In practice, a penetration test is the most credible way to satisfy that expectation, and it becomes a more explicit requirement at higher assessment levels or when a specific DoD contract calls for it. Many manufacturers run one anyway, because it's the clearest evidence you can hand a prime contractor that your controls hold up under real conditions.

A risk assessment is broad and administrative: it reviews your policies, configurations, access controls, and documentation to build a complete picture of where you stand against a framework like NIST SP 800-171. A penetration test is narrow and adversarial: it actively tries to break into specific systems the way an attacker would.

Example: the risk assessment might note that remote vendor access to a CNC controller lacks multi-factor authentication. The penetration test is what proves whether that gap is actually exploitable — and how far it lets someone go.

A vulnerability scan is automated — software checks your systems against a database of known weaknesses and produces a list, usually in a few hours. It's fast, cheap, and required regularly under NIST SP 800-171, but it doesn't tell you whether a listed weakness is actually exploitable in your specific environment.

A penetration test is manual, human-led, and goes further: a tester chains weaknesses together, tries to move from one system to another, and shows real impact — the difference between "this door has a weak lock" and "someone actually walked through it and reached the server room."

A manufacturing-aware pen test scopes in the connections between office IT and the shop floor — but testers generally don't run the same aggressive exploitation techniques directly against live PLCs or CNC controllers, since that risks disrupting production. Instead, they test whether an attacker who compromises the office network could reach OT systems, and whether network segmentation and remote vendor access actually hold.

This is usually the single most valuable part of the test for manufacturers, since it's exactly the path a real intrusion would take.

Testing generally moves through a few stages: reconnaissance (mapping your network and identifying targets), scanning (finding potential weaknesses), exploitation (actually attempting to use those weaknesses to gain access), and post-exploitation (seeing how far that access could go — other systems, other data, other network segments).

Scope and rules of engagement are agreed in advance, so nothing happens that could take down production or a critical system without your sign-off.

For a typical shop in AllTech's range — 15 to 100 employees, 25 to 250 endpoints — active testing usually runs one to two weeks, plus time upfront for scoping and rules of engagement, and time afterward for the written report. A facility with multiple sites or a more complex OT environment takes longer.

Cost depends on scope: how many systems and network segments are in play, whether external (internet-facing) and internal testing are both included, and whether the office-to-shop-floor boundary is being tested. It's typically priced as a fixed-fee project, separate from any risk assessment or ongoing managed security work.

Example: for AllTech's typical client — one primary site, 40 to 75 endpoints — a focused test covering the office network and its connections to production systems is generally a modest, fixed-fee engagement rather than an open-ended cost.

Without a recent test, you have documentation but no independent evidence that your controls actually work. That's a weaker position in a flow-down review, and it can slow down or stall a bid if a prime specifically asks for validated security testing as part of due diligence.

It's also a real operational risk on its own terms — untested controls fail silently, and the first time you find out is usually during an actual incident, not a scheduled review.

Annually is the general baseline, and also any time you make a significant network change — a new production line, a new remote-access setup for a vendor, a new facility, or a material change to your DoD contract scope. Vulnerability scanning should happen more frequently between full pen tests, since it's faster and catches newly disclosed weaknesses as they appear.

Look for testers who understand manufacturing environments specifically — comfortable scoping around live production equipment so testing doesn't risk downtime, and fluent in how DFARS and CMMC expectations tie into the results.

Also ask how findings connect to remediation. A report full of technical findings is only useful if someone can translate it into a fix list you can actually act on and, ideally, help implement.

1. We scope every test carefully around live production equipment, so testing doesn't risk downtime.

2. We specifically test the office-to-shop-floor boundary and remote vendor access, not just the office network.

3. Findings are ranked by real exploitability, not generic severity scores.

4. We can move straight from testing into remediation through managed security services.

5. Annual testing, plus testing after major network changes, keeps your evidence current for prime contractor reviews.