Audit or penetration test?
A security audit reviews controls, configurations and processes. A penetration test examines whether weaknesses can be exploited within an agreed scope. The right starting point depends on whether you need a broad review or validation of specific exposure.