Penetration testing plays a central role in the security assessment of modern enterprise environments, where heterogeneous infrastructures, multiple exposure surfaces, and in- creasingly sophisticated cyber threats make vulnerability evaluation more complex than in the past. In such contexts, purely ad hoc testing practices are often insufficient, while the adoption of a single methodological framework may not fully address the operational, organizational, and analytical requirements of enterprise security assessments. At the same time, automated tools have become essential for improving scalability and efficiency, although their outputs often require careful interpretation because of incomplete coverage, false positives, and limited contextual awareness. This thesis addresses the problem of how penetration testing methodologies can be structured and applied more effectively in enterprise environments by combining method- ological guidance, automation, and analytical support.