Effective Implementation of Penetration Testing in Small and Medium-sized Enterprises: Analysis of Methodologies and Tools

Penetration testing is a tool for verifying the security of digital systems, yet its effective implementation remains a challenge for small and medium-sized enterprises (SMEs), often due to limited financial and personnel resources or insufficient awareness of relevant cybersecurity risks. This work focuses on SMEs supplying e-shop solutions and performs a systematic analysis of four methodologies - NIST SP 800-115, PTES, OSSTMM, and OWASP WSTG, evaluating their actuality, flexibility, cost-effectiveness, and the comprehensiveness of penetration testing phase coverage considering SME specifics. The results of the comparative analysis indicate that the most suitable approach for these SMEs is a combination of the PTES process framework for planning and reporting with the technical procedures of OWASP WSTG for web application testing, as no single methodology is fully adequate. A practical case study on the OWASP Juice Shop platform confirmed the effectiveness of the proposed approach by identifying eight vulnerabilities, including two critical ones, while also highlighting the difficulty of objectively verifying the completeness of the tests performed, which represents a more general problem in this area. The overview of available tools and the recommended methodological procedure offers SMEs developing e-shops practical guidance for systematically improving the cybersecurity of their products.