Penetration testing is an iterative process that simulates the activities of malicious adversaries outside the network, trying to breach the perimeter. OSec identified critical assets during the initial threat assessment, and then targets these assets during the assessment.  A penetration test typically has three components that inform the next stage and repeat as needed: reconnaissance, enumeration, and exploitation.