Why would testers perform exploits during engagement?

• A. To reduce false positives and provide the client with proof vulnerabilities exist.
• B. To maximize disruption of operations.
• C. To avoid reporting to client.
• D. To provide attackers with access to all data.

Answer: (B)

Exploitation during a test is about turning a potential vulnerability into a demonstrated risk that the client can see in concrete terms. When testers exploit a flaw, they prove that the vulnerability can actually be abused, which provides undeniable evidence of impact and helps the client prioritize remediation. This also helps reduce uncertainty by showing there is a real attack path rather than just a theoretical weakness.

Exploitation is done within the agreed rules of engagement, with careful scope, permissions, and safeguards to minimize business disruption. The goal is to validate risk and provide actionable findings, not to cause maximum downtime or harm. Ethical testing seeks to demonstrate impact in a controlled way so the client can fix the vulnerability and strengthen controls.

So the aim is to provide proof that vulnerabilities exist and can be abused, enabling effective remediation and reducing the chance of false positives. It’s not about disrupting operations, hiding results, or exposing all data argh for attackers to misuse.