Penetration testing · Small and medium businesses
A penetration test for a business your size.
The price is stated before any conversation, and it follows the scope you set. The work is performed by certified engineers, reported in language a board can read, and attested in a signed letter that insurers and customers accept.
Real-time quote · No call, no wait
From $899 a year
An external test of your public systems, the report and the signed attestation letter. Additional areas are priced on screen as you add them.
How many people work at your company?
More than 100? Talk to us
CISSP
CEH
CISA · CISM
01 / What you receive
The report, as a client received it
A penetration test of a web application and the API behind it, delivered to a client and anonymized for sharing: thirty pages, fourteen findings with their proof of concept, the risk matrix and the remediation priorities, exactly as delivered. Read it before you decide; no email is asked.
- 03 Executive summary and the overall rating
- 09 A High finding: authorship forgery on upload
- 16 Its proof of concept, values masked
- 28 Vulnerabilities overview, all 14 in one table
02 / Who tests you
Certified people, under rules in writing
Automated scanners find what is easy to find. The findings that matter, the ones an attacker would use, are found by a person who understands how your business operates and what it cannot afford to lose. Every N30 engagement is performed and signed by a certified engineer; the scanner is an instrument, never the author.
The team holds more than eighteen professional certifications between them, among them CISSP, CEH, CISA and CISM, and serves banks, municipalities and healthcare organizations under the same written rules that will govern your engagement.
03 / How it goes
Four steps, no sales call
- 01
Set the scope
Choose the size of your company and the areas to be tested. The price is on screen before you commit to anything.
- 02
Pay
By card or bank account on Stripe’s secure page. You receive the receipt; we request the addresses to be tested and a point of contact.
- 03
We test
Certified engineers test the agreed scope to OWASP, PTES and NIST SP 800-115. Read-only wherever reading suffices; nothing is disrupted to prove a point.
- 04
You receive the evidence
The report, ranked by what to fix first, and the signed attestation letter. The engineer who performed the work presents the findings to you and to your IT provider.
04 / Why now
Why a business your size is asked for one
Your cyber insurer
Applications and renewals ask whether your systems are tested, by whom and when. The signed letter answers in one page.
Cyber insurance applicationsYour customers
Vendor security questionnaires ask for your most recent penetration test before a contract is signed, and again at each renewal. The report and the letter are the answer.
Vendor security questionnairesThe card brands
Any organization that stores, processes or transmits cardholder data must have a penetration test performed at least annually and after any significant change.
PCI DSS v4.0, requirement 11.4The FTC Safeguards Rule
Financial institutions under the rule, from mortgage brokers and tax preparers to dealers that finance, must perform annual penetration testing or monitor their systems continuously.
16 CFR 314.4(d)(2), in force since June 202305 / Questions
Questions you will have
- Is the test safe for our systems?
- Yes. Testing is read-only wherever reading suffices; every write test is declared in advance and reversed; nothing is exploited beyond what proves the finding. Denial-of-service techniques are never used. You set the testing window and name an emergency contact before the first packet is sent.
- What do we need to provide?
- The size of your company and the areas to be tested, here. After payment: the addresses to be tested and a point of contact. For an application test with an account, a test account that you create and later remove.
- What does the $899 include?
- The smallest engagement: an external penetration test of your public systems as an attacker sees them, the report, and the signed attestation letter. Additional areas, such as a web application or your cloud configuration, are priced on screen as you add them, and the total is shown before you commit.
- What happens if you find something serious?
- You are informed the same day, ahead of the report, with the one step that closes the exposure. A serious finding discovered by your own test is a decision; the same finding discovered by someone else is an incident.
- Who sees the results?
- You, and the engineer who performed the work. The report is your property; we retain only what the engagement requires, and we never name you as a client without your written permission.
- Can we cancel?
- The engagement is annual. The renewal can be stopped at any time from the billing page Stripe provides; the year you have paid for is delivered in full.
06 / For the board
Could someone get in today?
A penetration test answers the question with evidence instead of assurance: a qualified engineer, authorized in writing, tries to get in the way an attacker would, and reports what worked, what it reached, and what to fix first. This page says what is true outside, what the question means inside, and how the work is put in order.
The world outside
The world outside: what an attacker sees
Every organization with a public web application or an API is tested every day, by people who were not invited. The OWASP Top 10, revised in 2025, names the classes of weakness they use, and the first of them is still broken access control: the application checks who you are and then forgets to check what you may see. In one test on this site, five of the fourteen findings were High, and all five had that single root cause: a token was authenticated, the record it asked for was not authorized, and a resident’s personal data could be read by changing a number in the address.
Regulators have stopped treating this as optional. New York’s financial services regulation requires an annual penetration test of covered entities from inside and outside; the payment card standard requires one each year and after any significant change; the SEC requires a public company to disclose a material incident within four business days of deciding it is material. The test is no longer only a technical exercise; it is the evidence a board can point to when asked what it knew, and when.
The world inside
The world inside: the question behind the question
When a board asks whether someone could get in today, it is rarely asking for a vulnerability count. It is asking whether the people responsible know, and whether what they know is current. A security team can be competent and still blind to its own application: the people who built it test the paths they designed, and an attacker takes the ones they did not. The honest answer most executives carry is not "no" but "we have not looked the way an attacker would, recently, with someone who did not build it."
There is a second weight: the fear that looking will find something, and that finding it creates an obligation. It does, and that is the point. A finding discovered by your own test is a decision; the same finding discovered by someone else is an incident. The test moves the discovery to the side of the table where it can be ranked, budgeted and fixed, with a named owner and a date, before it has a cost that cannot be planned.
Putting it in order
Putting it in order: how the work is done
The order is fixed and written down before anything is touched. Scope and written authorization first: which applications, APIs and networks, from which perspectives (anonymous, a user, an administrator), in which window, with whose contact for an emergency stop. Then the surface is mapped from a recorded session of the application in use; then the tests, following OWASP for applications and APIs and PTES for networks, read-only wherever reading suffices, every write test named and reversed. Nothing is exploited further than proving the point.
What comes back is a report built to be acted on: each finding with its severity, the exact route or host, the proof that it worked, the fix and the effort, ranked by what to do first; an executive summary that names the one change carrying most of the gain; a risk matrix of severity against effort. A retest of every fixed finding is included, so the report’s last page is the one the board keeps: what was found, what was fixed, verified. A typical application and API test takes two to three weeks from authorization to the retest.
The first step
Choose the size of your company. The price is on screen before you commit to anything, and a certified engineer is behind every step that follows.