Penetration Testing

for Web Apps, Networks, PCI, Internal, & External

What is a Penetration Test?

Penetration testing helps to uncover architectural and conceptual issues through emulated, real-world attacks. The best way to know if your organization is susceptible to a security breach is to test your defenses. By evaluating the strength of your company’s infrastructure and revealing vulnerabilities, you can effectively manage those weaknesses.

How Does FRSecure Approach Penetration Testing Engagements?

FRSecure evaluates various points of exposure in your programs, systems, and networks, attempting to gain deeper levels of access and higher levels of security clearance. Once these access points are identified, we’ll work with you to build a plan that helps your company be better prepared to face threats.

Our penetration test services have been accepted to satisfy the requirements of HITRUST, ISO 27000-1, NIST CSF, FFIEC, NCUA, GLBA, FISMA, SOC2.

Penetration Testing

Things to Know

Penetration testing is an examination of how secure your systems, infrastructure, and buildings are—by attempting to exploit (or break into) them in a simulated attack. By having your security vulnerabilities exposed, you get a better understanding of where your security issues are and where improvements can and should be made.

Penetration test costs can vary based on what type of test you’re looking for and the makeup of your network. We’d recommend getting a custom quote to get an accurate picture. That said, here is a typical range:

External Network Penetration Test Pricing

  • $6,000 for a small business (fewer than 100 employees) with fewer than 5 active, public-facing IPs.
  • $15,000-$20,000 for a medium-sized business (100-500 employees) with fewer than 25 active, public-facing IPs.
  • $20,000-$30,000 for upper mid-market companies (1,000-3,000 employees) with 25-50 active, public facing IPs.
  • $50,000+ for large companies (fortune 500-ish) with hundreds of active, public-facing IPs.

Internal Network Penetration Test Pricing

  • $10,000 for a small business (fewer than 100 employees) with <100 network devices.
  • $10,000-$15,000 for a medium-sized business (100-500 employees) with <500 network devices.
  • $25,000-$50,000 for upper mid-market companies (1,000-3,000 employees) with <3,000 network nodes.
  • $75,000+ for large companies (fortune 500-ish) with thousands of network nodes.
  • Methodology: Ensure your penetration tester uses documented and repeatable methods based on industry standards.
  • Reporting: Expect an executive summary or a full report with “attack narrative” and appropriate, doable recommendations rooted in reality.
  • Experience: Ensure you’re not just getting some “script kiddie.” Vet your penetration tester for experience, background, and certifications.
  • Human Engagement: It’s common to have fully automated pen tests these days. At a minimum, a penetration test’s results should be interpreted for you by an experienced tester.
  • Limitations: Don’t limit your engagement by choosing what a tester can test. The less you allow, the less similar it becomes to a real-world attack.
  • Expectation Match: It’s important to work with an organization that will pair you with a tester who matches your current security objectives and has your best interests in mind.
  • Timing: If you haven’t done a full security risk assessment, a penetration test could be like walking through an open door. You need to have proper security measures in place to test their effectiveness.

Tests Offered

Consists of enumerating and verifying vulnerabilities that could be exploited by external attackers to gain unauthorized access to your systems. FRSecure’s team plays the role of an external attacker, attempting to exploit vulnerable systems to obtain confidential information or compromise network perimeter defenses.

Focuses on determining the potential business impact of a security breach and validating the level of effort required for an attacker to overcome your security infrastructure. After access is gained, FRSecure identifies configuration issues and vulnerabilities that can be exploited. Using that information, FRSecure attempts to complete several objectives that are designed to replicate common attacker behaviors.

With specific goals set by the PCI Security Standards Council, this test involves both external and internal penetration test methodologies. The two main objectives of this test are; 1) To determine whether and how a malicious user can gain access to assets that affect the fundamental security of the systems, files, logs and cardholder data; 2) To confirm that the applicable controls required by PCI DSS are in place.

Measures the effectiveness of security training, internal procedures, and technical controls by attempting physical access to your organization. FRSecure staff will pose as a legitimate person or company (fire inspector, exterminator, power company technician, etc.) and then attempt to gain access to restricted areas, obtain a physical network connection, or access unattended workstations or information stores.

A more holistic standard of penetration testing. Red teams simulate real-world attacks that focus on the effectiveness of an entire information security program utilizing the same tools, tactics and techniques that adversaries would likely employ. The goal is different in that adds focus to people and process, not just a particular sub-system within your tech stack.

Focuses on evaluating the security of a web application by using aspects of the Penetration Testing Execution Standard (PTES) and the OWASP standard testing checklist, and involves an active analysis of the application for any weaknesses, technical flaws or other vulnerabilities. You’ll receive an assessment of the potential impact, steps to reproduce the issue if applicable, and FRSecure’s recommendations for remediation.

An Industry Leader

Clutch—a platform for businesses to search for potential vendors across a number of industries—has put together a list of the top-ranked penetration testing companies. Based on interviews conducted by Clutch with actual customers, FRSecure has been rated Clutch’s second-best penetration testing provider.

Clutch Penetration Testing Leader Matrix