The practice of testing a computer system, network, or web application to find security vulnerabilities that an attacker could exploit.