A method for performing automatic penetration testing (PT) in an organization having at least one end unit, the method comprising: providing a PT device having a PT algorithm stored in a memory unit; connecting the PT device to an active network port in the organization; performing automated penetration testing, comprising: scanning the network to identify all end units and vulnerabilities in the network; creating possible attack scenarios; attacking the network according to the PT algorithm, and based on the attack scenarios; and creating a vulnerability report, wherein the PT algorithm simulates the operation of a real hacker, and wherein overloading the network is prevented.