Frequently Asked Questions

Determining the cost of a penetration test depends on various factors, such as the size and complexity of the network or application, and the goals of the test (basic versus in-depth manual testing). It's essential to customize the test to align with both technical and financial objectives. The average hourly rate for a penetration tester ranges from $150 to $300.

The duration of a penetration test can vary significantly due to several factors:

• Scope and complexity: Larger and more complex networks or applications require more time to assess thoroughly. Simple tests might be completed in a week, while complex environments can take months.
• Test goals: Basic automated tests are quicker than in-depth manual testing, which includes social engineering and business logic assessments.
• Environment understanding: Properly understanding the environment and/or business logic of an application takes time but is important to ensure an accurate evaluation.

Regular penetration testing helps maintain a robust security posture in the face of emerging threats.

Given the fast-evolving nature of technology and threat landscape, it's recommended to conduct a penetration test at least once a year. Regular testing helps organizations stay proactive in their security measures and technology decisions, rather than reacting to suspicious activity.

Significant changes to the network, applications, or regulatory requirements may warrant more frequent testing to ensure continuous protection.

A penetration test should not cause an outage for any network or application. However, unforeseen impacts may arise due to unique configurations or preexisting conditions within the environment. This underscores the importance of sharing detailed information about the environment or application with the penetration testing team.

To ensure accuracy and minimize the risk of disruption, detailed testing should be performed in a test environment, followed by a final posture check in the production environment.

Maintaining open communication throughout the testing process is also crucial to address any potential issues promptly.

The risks associated with a penetration test often stem from unintended consequences rather than deliberate actions by the tester. For example, a configuration that triggers excessive alerts could overwhelm an organization with notifications, potentially causing volume overload or missed alerts from other activities.

A Master Service Agreement (MSA) addresses organizational protection and negligence, but given the manual nature of penetration testing, unintentional impacts are possible. Working with experienced testers who can anticipate impacts and reduce the use of unnecessarily “noisy” tools reduces these risks.

Testers do not typically have access to sensitive information directly. However, if they can pivot within the network or application, they might encounter stored sensitive data. It's essential to keep open communication with the tester so that if this occurs, you're notified, and the information is handled properly.

Typically, mass exfiltration of data is not required to prove a vulnerability. Instead, our testers focus on demonstrating the ability to access data without actually extracting it. This minimizes risks while effectively showcasing potential security issues.

Additionally, establishing clear guidelines and boundaries before the test can help ensure that sensitive information is handled appropriately. This includes defining what types of data the tester can interact with and what actions should be taken if sensitive data is encountered.

Your involvement in a penetration test is crucial for ensuring its quality and depth. Maintaining an open line of communication between the testing team and the project owner allows for a better return on your investment. This collaboration doesn’t give the tester an unfair advantage but instead enhances the test’s effectiveness.

Key aspects of your involvement include:

• Providing context: Share relevant information about your environment and potential concerns.
• Facilitating access: Ensure the tester has the necessary permissions and access to perform the test.
• Ongoing communication: Keep an open dialogue to address any issues or questions promptly.
• Reviewing findings: Participate in reviewing and understanding the test results to inform remediation efforts.

The process of a penetration test involves several key steps to ensure a thorough and effective assessment of your network and applications. Here's a breakdown of the typical process:

• Contract and scope agreement: Establish the terms and objectives of the penetration test.
• Kickoff meeting: Ensure both the testing team and client understand their roles, answer questions, and establish communication channels.
• Independent testing: The testing team works independently, simulating real-world threat actors, with periodic updates to the client.
• Regular Updates: Maintain ongoing communication to ensure the test is on track and questions are answered.
• Reporting: The testing team documents the vulnerabilities identified and provides customized remediation suggestions.
• Report review: The testing team provide a walkthrough of the findings.
• Remediation and support: The client works on remediation, with support from the testing team as needed.
• Retest: Some companies offer a retest to ensure remediations are correctly implemented.

Determining the best type of penetration test for your organization involves consulting with a reputable penetration testing company. They can assess your specific needs and recommend the most suitable test. This is typically free of charge.

Penetration test: A penetration test involves a human tester (or team of testers) manually exploring your network or application like a real threat-actors to identify vulnerabilities. While tools may assist, the process is primarily driven by human expertise to provide a detailed assessment.

Vulnerability scan: This is an automated process that generates a report of known vulnerabilities, outdated technologies, and missing patches. It is generic and not tailored to specific needs, focusing on identifying common security issues.

Bug Bounty: In a bug bounty program, a client registers and invites ethical hackers to find vulnerabilities in exchange for compensation. Hackers are paid only when they successfully identify and report a valid vulnerability. This method leverages a diverse pool of talent but can be less controlled than a traditional penetration test. Bug bounty programs require a certain level of security maturity. Without this, they can become overwhelming and costly.

All three can be complementary rather than mutually exclusive. Utilizing vulnerability scans for regular automated checks, penetration tests for in-depth evaluations, and bug bounty programs for leveraging a broad pool of expertise can provide comprehensive security coverage between penetration tests. Combining these approaches ensures a robust and layered defense strategy.

A penetration test can be either manual or automated, but most often it is a combination of both. Automated scans are used to identify low-hanging fruit with generic recommendations, while manual testing allows the tester to chain multiple vulnerabilities and think like threat-actors. This blended approach ensures a thorough and effective evaluation of the security posture, leveraging the strengths of both automated tools and human expertise.

A path to compromise provides a visual and clear picture of how a penetration tester breached your network or application. This is important because breaches are typically not caused by a single vulnerability, but rather by a series of misconfigurations and vulnerabilities that allow the attacker to pivot to areas they shouldn't access. Understanding this path helps identify and rectify the sequence of weaknesses, thereby strengthening overall security posture and preventing similar breaches in the future.

Selecting the right penetration testing vendor is crucial for ensuring a thorough and effective security assessment. Here are key questions to ask when making your decision:

• Experience and expertise: Ask about their business duration, certifications, and references.
• Scope and methodology: Inquire about scope definition, methodologies, tools, and issue handling.
• Reporting and communication: Check report formats, update frequency, and follow-up processes.
• Compliance and standards: Confirm adherence to industry standards and regulations.
• Post test support: Ask about remediation support and follow-up testing.
• Cost and value: Understand cost structures, additional fees, and value assurance.
• Security and confidentiality: Ensure data protection and confidentiality measures.

It's not necessary to change vendors frequently if you're satisfied with their services. Retaining the same company for several tests or years provides continuity and ensures the testing team has a deep understanding of your systems. This familiarity leads to more effective and efficient testing, allowing for a deeper examination to uncover more obscure vulnerabilities.

Sometimes penetration testing companies rotate the testing team to gain fresh perspectives while retaining important knowledge about the environment or application.

Consider changing vendors if you experience issues with quality, communication, or if your current vendor cannot meet evolving security needs. Regularly evaluate the performance and effectiveness of your penetration testing provider to ensure they align with your security goals.

Compliance can be a driver for conducting a penetration test, but it should not be the primary objective. Compliance represents the minimum requirement, while a comprehensive penetration test aims to exceed these standards by identifying vulnerabilities and paths to compromise, thereby enhancing the overall security posture. Achieving compliance is essential; however, true security demands a proactive and thorough approach, going way beyond meeting regulatory requirements to ensure robust protection against potential threats.

Every small or large business can benefit from a penetration test to evaluate its security posture. Consider the following factors:

• Risk appetite: Businesses with a low tolerance for risk benefit from regular penetration testing to proactively identify and mitigate vulnerabilities.
• Sensitive data handling: If your business handle confidential information, penetration tests help identify attack vectors and protect against potential breaches.
• Previous security incidents: If you've experienced breaches or security incidents, penetration testing can help identify and fix other unexploited vulnerabilities.
• New deployments or major changes: Launching new applications or infrastructure can introduce risks that a penetration test can uncover.