Penetration Testing Checklist

Penetration tests range in price, depending on the size of your network and specific needs. Tests usually range from $15,000 to $30,000. As a general rule, any "pentest" that is listed for less than $4,000 is likely not a real penetration test.

At SecurityMetrics, we have customers who take weeks and some who take less time. It really depends on the complexity of your environment and what your objectives are.

There are many industry standards that require a penetration test, including PCI, SOC, HIPAA, GDPR, and more. For organizations that don't need to adhere to specific compliance standards elective pentests can be performed to gauge your security posture. Remember, if you make significant changes to your environment, you will need to perform a penetration test again.

Sometimes customers call asking about penetration testing and realize they actually just need a vulnerability scan. Vulnerability scans must be performed by someone who is a certified vendor. They are more affordable than a penetration test and completely automated. They focus on finding potential vulnerabilities and identifying them for you so you can go through the vulnerabilities and make the needed changes to test again. For PCI requirements, you must perform vulnerability scans once every 90 days. 

Penetration testing tries to exploit the found vulnerabilities. Also known as ethical hacking, SecurityMetrics penetration testers start with your vulnerability scan and see if they can hack into your network. Penetration testing is much more hands-on and time-consuming, making it much more expensive than vulnerability scanning