Home / Services / Penetration testing
Pentest
Penetration testing
Fixed-price tests of your external perimeter, internal network, web applications, cloud and wireless, with a free retest.
Testing is manual, scoped in a 30-minute call, priced in writing before we start and run under signed rules of engagement. Reports are written for two audiences: an executive summary a board can read, and findings with reproduction steps, evidence and remediation your engineers can act on. Every test includes a retest of fixed findings within 90 days and a letter of attestation for your customers, auditors and insurer.
from $2,400 fixed price
What is included
- Manual testing by senior testers; automated scanning is the starting point, not the deliverable
- Scoping call, written quote and rules of engagement before any traffic is sent
- Findings rated with CVSS 4.0 and a plain-English business impact
- Report delivered in the portal with a readout call for your team
- Retest of remediated findings within 90 days, included
- Attestation letter for customers, auditors and cyber insurers
What you receive
- Rules of engagement and emergency contact sheet
- Executive summary and technical report (PDF and portal)
- Evidence package: screenshots, request logs, proof-of-concept scripts where safe
- Retest report and attestation letter
How it runs
- 1
Scope
Thirty-minute call to count IPs, applications, roles and cloud accounts; fixed price the same day.
- 2
Authorize
Rules of engagement signed, test window set, emergency contacts exchanged.
- 3
Test
Five to fifteen business days of manual testing with daily check-ins on anything critical.
- 4
Report and retest
Readout call within a week of testing; retest when you say the fixes are in.
Questions about penetration testing
How is this different from a vulnerability scan?
A scan lists known weaknesses by version number. A penetration test chains them: a tester tries to get from the outside to your data the way an attacker would, and shows you exactly how far they got.
Will testing take systems down?
Denial-of-service testing is excluded unless you ask for it in writing. Testers work in the window you set, call before anything risky, and stop on request.
Our customer or auditor requires an annual test. Is this enough?
Yes for SOC 2, PCI DSS 11.4, HIPAA and most customer security questionnaires. The attestation letter states scope, dates, methodology and the status of findings at retest.
Other services
Scope penetration testing for your environment.
Thirty minutes with the people who will do the work, and a fixed price in writing the same day.