Penetration Testing for Businesses

What penetration testing is and what it proves

Penetration testing shows whether an attacker could get into your systems and how far they could go, by having skilled testers try under a written agreement. The FTC Safeguards Rule defines it as a test in which assessors attempt to circumvent or defeat the security features of an information system, from outside or inside ⁴.

That makes it different from most security services. MDR and a SOC watch for attacks; a pen test is a planned attack that tells you where those defenses fail. Common types of penetration testing services:

• External network test. Testers attack what faces the internet: firewalls, VPNs, email gateways, remote access portals. Given that exploited vulnerabilities were the top initial access route in Verizon's 2026 DBIR, at 31% of breaches ⁵, this is where most small firms start.
• Internal network test. Testers start as if they were an infected laptop or a rogue insider and try to reach domain admin, file shares and finance systems.
• Web application test. Testers attack a customer portal, app or API for flaws such as broken login, data exposure and injection.
• Cloud and Microsoft 365 configuration review. Often bundled with a pen test, it checks sharing settings, admin roles and conditional access.
• Social engineering. Phishing or phone pretexting against staff, with permission from leadership.

Pen testing should be done by a firm that does not manage your systems, so nobody is grading their own work. If you already have an MSP or managed security provider, hire the tester separately.

Pen test vs vulnerability scan vs red team

A vulnerability scan lists known weaknesses automatically; a penetration test has people exploit them to prove real risk; a red team exercise tests whether your monitoring and response catch a stealthy, goal-driven attack. They are not substitutes for each other.

Vulnerability assessment and scanning services come in two forms. You can license a scanner yourself: Tenable lists Nessus Professional at $4,790 a year and its cloud vulnerability management at about $3,700 a year for 100 assets ³. Or a provider runs the scans, triages results and tracks fixes as a vulnerability management service, often bundled into managed IT or managed security. A scan report with 400 findings and no one assigned to fix them does not reduce risk.

Red team services make sense only when you already have 24/7 detection, such as MDR or a SOC, and want to know whether it works. Most companies under 500 staff get more from a yearly pen test plus continuous scanning.

What penetration testing costs

Penetration testing cost depends mainly on scope: how many IP addresses, network segments, applications and user roles the testers must cover. Two testing firms' published 2026 guides give these ranges:

• External network: $5,000 to $10,000 for 1 to 25 IPs ¹; $5,000 to $20,000 across a broader set of quotes ².
• Internal network: $7,500 to $12,000 for 1 to 2 VLANs ¹; $7,000 to $35,000 more broadly ².
• Web application: $3,500 to $6,000 for a simple app ¹; $5,000 to $30,000 overall, with simple SaaS apps at $4,999 to $8,999 ².
• Annual budget: Compass recommends $8,000 to $20,000 a year for businesses with 1 to 50 staff ¹.

These are single firms' published estimates, not a neutral survey, so use them as a sanity check on quotes. Freelance testers on Upwork list $60 to $120 an hour ⁶, but a freelancer may not carry the insurance, methodology and report quality that an insurer, auditor or customer will accept.

Very low quotes for a "pen test" are often an automated scan with a new cover page. Ask how many tester hours are included and whether findings are manually verified and exploited.

How to scope a penetration test

Good scoping starts from what you need to prove and to whom, then lists exactly which systems are in and out. Before asking for quotes, write down:

1. The reason. Insurer requirement, a customer's security questionnaire, PCI, the FTC Safeguards Rule, CMMC preparation, or your own risk. The reason decides which tests matter.
2. External targets. Public IP addresses, domains, VPN and remote access portals, and any internet-facing servers.
3. Internal targets. Number of office locations, network segments, servers and whether a domain controller is in scope.
4. Applications. Each web app or API, how many user roles it has, and whether testers get test accounts.
5. Cloud. Microsoft 365, Google Workspace, AWS or Azure tenants to review.
6. Rules of engagement. Testing windows, systems that must not be disrupted, who to call if something breaks, and written authorization from someone who has the authority to give it.
7. Retest. Whether one retest of fixed findings is included in the price.

A cybersecurity risk assessment beforehand helps you decide which systems carry the most risk and should be tested first.

How often to test, and who requires it

Most organizations that test should do so at least once a year and after significant changes, which is what the main rules ask for. The rules that most often drive testing at small and midsize companies:

• PCI DSS. The PCI Security Standards Council's 2017 penetration testing guidance, written for PCI DSS 3.2, calls for penetration testing at least annually and upon significant changes, and vulnerability scans at least quarterly and after significant changes ⁷. Confirm current requirements with your acquiring bank or QSA.
• FTC Safeguards Rule. Covered financial firms, including tax preparers, that do not run effective continuous monitoring must conduct annual penetration testing and vulnerability assessments at least every six months ⁴. Firms holding data on fewer than 5,000 consumers are exempt from this provision ⁴. See our written information security plan page.
• HIPAA. The current Security Rule requires periodic technical evaluation ⁸. A proposed update would require vulnerability scanning at least every six months and penetration testing at least every 12 months ⁹; it is still a proposal, and HHS says the current rule remains in effect ¹⁰. See HIPAA compliance services.
• CMMC. CMMC Level 2 uses the 110 requirements of NIST SP 800-171 Rev 2, which include periodic vulnerability scanning ¹¹; Level 3 requires penetration testing at least annually or after significant security changes ¹². CMMC Phase 2 is suspended and the schedule may change ¹³. See CMMC.
• Cyber insurance. Insurers look for patch and vulnerability management among their key controls ¹⁴, and some applications ask when you last ran a pen test. See cyber insurance requirements.

These summaries are not legal advice. Confirm your own obligations with counsel, your assessor or your QSA.

What a good pen test report contains

A good report lets an owner understand the risk in two pages and lets your IT team fix every finding without calling the tester. Look for:

• Executive summary in plain language: what was tested, the worst outcomes reached (for example, "domain admin from a guest Wi-Fi port"), and the top fixes.
• Scope and method: exact targets, dates, tester names and the methodology followed.
• Each finding with a severity rating, affected systems, proof such as screenshots or commands, the business impact and specific fix steps.
• Attack narrative showing how findings were chained together.
• Retest results confirming which findings are now closed.
• An attestation letter you can share with customers or insurers without exposing the full report.

Then fix the findings. Your managed IT provider or managed firewall provider usually does the remediation; a vCISO can track it to closure.