A hacker will typically have downloaded open ware software on the Internet and have set up a hacking tool to run overnight. That software will scan the Internet worldwide looking for vulnerable targets. The software finds IP addresses and tells the hacker of those IPs and their vulnerabilities. 

Meanwhile internally, your penetration tester monitors people who are behind possible security breaches within the organisation and launches an attack on it finding a critical vulnerability to start testing immediately. 
They then tell the client what they’ve found and only carry on fixing it once they are told to proceed. 

Following the ethical hack, our experts would document and recommend action, only acting when agreed to do so. Next steps rate the vulnerabilities in the system from critical to low and report for each member of the board to decide on appropriate solutions going forward. At this stage the IT manager is also contacted and will decide on the resources needed to resolve the problem.