Penetration Testing services

A Penetration Test (also known as ethical hacking or a pen test) is an authorised hacking attempt, targeting your organization’s IT network infrastructure, applications and employees.

The purpose of the test is to strengthen your organization’s security defences by identifying areas that are susceptible to compromise (vulnerable) and advising on remediation.

Outside of meeting a specific compliance requirement, penetration tests should be performed at least annually, or more frequently for organizations with a high-risk profile.

There is no standard answer for the time it takes to conduct a penetration test, as it depends on the objectives, approach, and the size and complexity of the environment (attack surface) to be tested – the scope of the work to be undertaken.

An app or small environment can be completed in a few days, but a large, complex environment can take weeks.

There is no universal price for a penetration test.

A good quality penetration tester will provide a consultation to understand your organization’s aims and objectives and determine a high-level threat model (to understand the full scope of work) before they provide a quote.

A penetration test report lists the identified vulnerabilities and exploits, categorised according to risk level and recommendations for remediation based on key insights into the cyber-threat landscape.

A good-quality penetration tester will also conduct debriefing sessions targeting two separate audiences:

• A technical debriefing aimed at system administrators and engineers. The technical briefing is intended for knowledge transfer – of the lessons learned during the penetration test – to the IT security team.
• An executive debriefing tailored for the technology management group. This session provides the information needed to determine the appropriate risk management strategy.

Including regular penetration testing in your ongoing cyber security and information security management program is the best approach.

Compliance requirements mandate regular penetration testing – for example, PCI DSS compliance requires penetration testing at least annually or during infrastructure and application modifications and upgrades that significantly change the environment.

Unfortunately, many organizations aim to meet only the minimum requirements of penetration testing to achieve compliance – and believe themselves to be secure. This is a dangerous mindset.

As the threat landscape is ever-evolving, your cyber security company will be your best point of contact to advise on the frequency and level of compliance required to meet your organization’s specific risk profile and cyber security needs.