Which one of the following is not an attack but a search for vulnerabilities to attack?

Penetration testing is not an attack but a controlled and authorized process of searching for vulnerabilities in a system in order to identify and address them before they can be exploited by malicious actors.