Penetration Testing

External penetration tests are focused on discovering and exploiting external assets and services to simulate what an attacker would do to compromise systems or gain access to your company's internal resources.

Internal penetration tests are focused on discovering and exploiting internal assets and services to simulate how attackers would pivot through your network, escalate privileges, and compromise systems.

Application penetration tests are focused on bespoke applications or APIs to simulate how an attacker would identify and exploit common web application vulnerabilities such as those listed in the OWASP Web Security Testing Guide.

Did you know that 90% of breaches occur because of social engineering? Phishing Engagements are focused on identifying and exploiting employees through social engineering in order to gain access to your company's internal resources. Phishing Engagements can be added on to External Penetration Tests.

Mobile penetration tests are focused on bespoke Mobile Applications to simulate how an attacker would identify and exploit common Mobile Application vulnerabilities such as those listed in the OWASP Mobile Application Security Testing Guide.

A network pen test is used to locate security issues within your design, implementation, and maintenance of servers, workstations, and network services.

A network pen test is used to locate security issues within your design, implementation, and maintenance of servers, workstations, and network services.

Penetration tests range in price, depending on the size of your network and specific needs. Tests usually range from $15,000 to $30,000. As a general rule, any "pentest" that is listed for less than $4,000 is likely not a real penetration test.

At SecurityMetrics, we have customers who take weeks and some who take less time. It really depends on the complexity of your environment and what your objectives are.

Check out the Penetration Testing Timeline Checklist for more details.

There are many industry standards that require a penetration test, including PCI, SOC, HIPAA, GDPR, and more. For organizations that don't need to adhere to specific compliance standards elective pentests can be performed to gauge your security posture. Remember, if you make significant changes to your environment, you will need to perform a penetration test again.

Sometimes customers call asking about penetration testing and realize they actually just need a vulnerability scan. Vulnerability scans must be performed by someone who is a certified vendor. They are more affordable than a penetration test and completely automated. They focus on finding potential vulnerabilities and identifying them for you so you can go through the vulnerabilities and make the needed changes to test again. For PCI requirements, you must perform vulnerability scans once every 90 days.

Penetration testing tries to exploit the found vulnerabilities. Also known as ethical hacking, SecurityMetrics penetration testers start with your vulnerability scan and see if they can hack into your network. Penetration testing is much more hands-on and time-consuming, making it much more expensive than vulnerability scanning

You should look for certain certifications when choosing a pentester. SecurityMetrics pentesters have CISSP, OSCP, BSCP, and more. SecurityMetrics pentesters want you to be safeguarded against threat actors, so they take their training and your pentest seriously.

SecurityMetrics also holds its own testing program once a year where pentesters go up against their own servers to determine any vulnerabilities and the effective rate of exploiting them. Sometimes pentest firms are doing as little as possible to sign you off. SecurityMetrics penetration testers want you to be safeguarded against threat actors, so they take your pentest seriously.