How much does a penetration test cost?

Penetration test costs can vary based on what type of test you’re looking for and the makeup of your network. We’d recommend getting a custom quote to get an accurate picture. That said, here is a typical range: External Network Penetration Test Pricing $6,000 for a small business (fewer than 100 employees) with fewer than 5 active, public-facing IPs. $15,000-$20,000 for a medium-sized business (100-500 employees) with fewer than 25 active, public-facing IPs. $20,000-$30,000 for upper mid-market companies (1,000-3,000 employees) with 25-50 active, public facing IPs. $50,000+ for large companies (fortune 500-ish) with hundreds of active, public-facing IPs. Internal Network Penetration Test Pricing $10,000 for a small business (fewer than 100 employees) with <100 network devices. $10,000-$15,000 for a medium-sized business (100-500 employees) with <500 network devices. $25,000-$50,000 for upper mid-market companies (1,000-3,000 employees) with <3,000 network nodes. $75,000+ for large companies (fortune 500-ish) with thousands of network nodes.

What should I be mindful of regarding penetration testing?

Methodology: Ensure your penetration tester uses documented and repeatable methods based on industry standards. Reporting: Expect an executive summary or a full report with “attack narrative” and appropriate, doable recommendations rooted in reality. Experience: Ensure you’re not just getting some “script kiddie.” Vet your penetration tester for experience, background, and certifications. Human Engagement: It’s common to have fully automated pen tests these days. At a minimum, a penetration test’s results should be interpreted for you by an experienced tester. Limitations: Don’t limit your engagement by choosing what a tester can test. The less you allow, the less similar it becomes to a real-world attack. Expectation Match: It’s important to work with an organization that will pair you with a tester who matches your current security objectives and has your best interests in mind. Timing: If you haven’t done a full security risk assessment, a penetration test could be like walking through an open door. You need to have proper security measures in place to test their effectiveness.

Penetration Testing Services

Reveal Security Flaws via Real-World Attacks

Internal, External, Physical Bypass, Red Teaming, Wireless, and Web App Pen Testing

Hire our award-winning team of ethical hackers who use modern penetration testing techniques to identify weaknesses and point out what gaps need to be filled.

What is a Penetration Test?

Top-tier security experts to identify existing security weaknesses

Penetration testing helps uncover architectural and conceptual issues through emulated, real-world attacks. Our team of ethical hackers works to gather information about your systems, applications, and assets to identify gaps that allow attackers unauthorized access to your systems. Ultimately, this information will be presented back to you—allowing you to fix those weaknesses before they are exploited by true adversaries.

We hire the best of the best. Penetration testing is more than just a job for our Pen Testers; you can trust they will go to great lengths to discover your vulnerabilities.

Pen Testing Services

Six Types of Penetration Testing

External Pen Testing

Exposing vulnerabilities in your internet-facing systems, networks, firewalls, devices, and/or web applications that could lead to unauthorized access.

Internal Pen Testing

Validating the effort required for an attacker to overcome and exploit your internal security infrastructure after access is gained.

Web App Pen Testing

Application security testing using attempted infiltration through a website or web application. Testers use PTES and the OWASP standard testing checklist.

Physical Bypass

Walking through your facility with a member of your team, an FRSecure expert will evaluate physical security controls (doors, locks, walls, surveillance, etc.) for an opportunity to circumvent them.

Red Teaming

Real-world simulation utilizing a mix of social engineering and external and internal network-level testing.

Wireless Pen Testing

To help you understand where your wireless network security could be improved, we attempt to capture authentication information that provides access to the network and finish with radio and segmentation checks.

Penetration Testing Methodology

How is penetration testing done?

Intelligence Gathering

Using Open Source Intelligence (OSINT) techniques to gather sensitive information that could be used to enhance attacks.

Threat Modeling

Gather relevant documentation, identify and categorize primary and secondary assets, identify and categorize threats and threat communities, and map threat communities against primary and secondary assets.

Vulnerability Analysis

Vulnerability testing is the process of discovering flaws in systems and applications which can be leveraged by an attacker. These flaws can range anywhere from host and service misconfiguration, or insecure application design.

Exploitation

Obtaining access through vulnerabilities, configuration errors, or social engineering.

Post-Exploitation

The value of the machine is determined by the sensitivity of the data stored on it and the machine’s usefulness in further compromising the network.

Reporting

Communicate the objectives, methods, and results of the testing conducted.

What are the differences between vulnerability scanning,
penetration testing, and red teaming?

Determine the Best Fit for Your Organization

Fully Automated
Discover Vulnerabilities
Check if Controls Exist
Preventative Control Focus
Noisy & Obvious
For Low-to-Moderate Program Maturity

Human Interaction & Analysis
Discover & Exploit Vulnerabilities
Analyze Usage & Effectiveness of Controls
Preventative Control Focus
Noisy & Obvious
For Moderate-to-Mature Security Programs

Human Interaction & Analysis
Exploit Vulnerabilities & Gain Access
Analyze Usage & Effectiveness of Controls
Detective & Reactive Control Focus
Stealthy & Evasive
For Mature Security Programs

"For the internal and external penetration, I give them the information and they take it from there. We’ve made it through a number of bank exams without question. To me, that’s the key. We haven’t had breaches and stayed secure. We haven’t had any major issues with things we’ve implemented since becoming partners with them. I had good peace of mind working with them."

CTO

HomeTown Bank

The FRSecure Way

Why work with FRSecure?

Expertise

FRSecure’s penetration team is literally world-class. Having placed in the top three for three straight years at DEFCON’s Warl0ck Gam3z Capture the Flag, the team stacks up against the best hackers anywhere. Pair that with their experience, certifications, and unwavering commitment to helping your business improve its security and they really are some of the best the industry has to offer.

Mission

Our mission at FRSecure is to fix the broken information security industry, and part of that is flipping the switch from reactive thinking to proactive thinking. We aim to solve as many weaknesses as we can in your security environment, ultimately helping you grow your program and protect people. Penetration testing is one of the many ways we can help organizations be proactive about protecting their data.

Style

Our style isn’t “cookie cutter.” Our team of experts gets an idea of your business objectives before stealthily conducting intelligence gathering, threat modeling, vulnerability analysis, and exploitation to emulate real-world tactics. Then we provide post-exploitation analysis and reporting for your executive leadership.

Focus

Information security is all we do. We don’t do IT, sell hardware, or provide telco services. We only do security. Because of this, our penetration testing team can provide unbiased recommendations that will actually make a dramatic impact on the way you do security. Once the engagement is completed, we’ll ensure to educate your team to make improvements going forward.

“Our bank clients require us to do penetration testing to ensure our system is secure. We reached out to FRSecure to provide this service. FRSecure offers a valuable service with a professional approach. Facilitating a smooth process, they complete testing within a week and don’t require website downtime to do so. The testing report is thorough but comprehensible.”

Financial Manager

Mackoff Kellogg Law Firm