Penetration testing for businesses

The price depends on the scope, meaning the number of IP addresses, applications and sites, on the type of test (external, internal, web application) and on the method chosen. A smaller external test costs a fraction of what full testing of an entire environment does. Get in touch and after a short conversation about scope we will prepare a tailored, no-obligation quote.

An audit checks whether you have things set up correctly, meaning configurations, licences, processes and documentation. A penetration test practically verifies whether they can actually be broken through. The audit answers “is everything in order?”, the test answers “can someone get in?”. They work best together, and we recommend starting with a complete IT audit.

No. A scan is an automated tool that compares your systems against a database of known flaws and prints a list, which usually contains plenty of false alarms. A penetration test is done by a person who verifies each finding by attempting to exploit it. That is how you know what is a genuine risk and what is only a theoretical note.

It depends on the scope. A smaller external test is a matter of a few days, while full testing of a larger environment takes longer and is usually split into phases. We agree the exact timing and duration up front when defining the scope, so you know what to expect.

We plan tests so they do not put your operations at risk. Riskier steps are done by agreement outside working hours and we stay reachable during the test so anything can be stopped immediately. The scope, and the systems we must not touch, are agreed in writing beforehand.

In most companies, once a year. An extra test makes sense after a major change, for example after rolling out a new application, moving to the cloud, rebuilding the network or following a security incident. Between tests we recommend ongoing vulnerability scanning and monitoring.

The NIS2 Directive (EU) 2022/2555 does not explicitly list a penetration test as an obligation. It does, however, require you to adopt security measures and verify their effectiveness. A penetration test is one of the most direct ways to evidence that verification. You will find the details on our NIS2 page.

ISO/IEC 27001 requires technical vulnerability management and verification that measures are effective. It does not prescribe a specific form, but a penetration test report is commonly accepted evidence in both certification and surveillance audits. IT HELP itself holds ISO 27001 and ISO 9001.

A jargon-free executive summary for management, a technical section describing every vulnerability with proof and a severity rating, and a remediation plan ranked by priority. We go through the report with you and explain what to tackle first.

Yes, we adapt the scope of the test to the size of your company. Smaller companies are often targets of automated attacks that do not discriminate, and an external test of what they expose to the internet is frequently enough. If you are unsure, get in touch and we will tell you honestly whether a test makes sense for you.

Above all, written authorisation to test and a non-disclosure agreement. Then a contact person, a list of the systems in scope and those we must not touch. For internal and grey box tests we also need network access or a standard user account.

Yes. We work with clients wherever they are based. External and web tests are run remotely from anywhere, and for internal and physical tests we come to you on site.