Network Vulnerability Scan

< RETURN TO SERVICES PAGE

Network Vulnerability Scanning is one of our most simplistic services. It offers valuable testing for common vulnerabilities and identifies weaknesses in your network.

Basic Service

The basic service will run one or more industry standard vulnerability scanners against your network and deliver the raw report to you for review. Your information technology team would then review the findings, determine which are potentially false positives, and remediate the remaining issues.

You can review a sample report here: SampleNetworkVulnerabilityScanReport.pdf

Standard Service

The standard service includes everything in the basic service, and, in addition, each finding is verified and a custom Findings and Recommendations Report is created.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

External
- Micro: Less than 12 active IPs
  - Basic: $1,000
  - Standard: $2,500
- Small: Less than 25 active IPs
  - Basic: $1,500
  - Standard: $4,000
- Medium: Less than 75 active IPs
  - Basic: $2,500
  - Standard: $6,000
- Large: Less than 300 active IPs
  - Basic: $4,500
  - Standard: $9,000
- xLarge: More than 300 active IPs
  - Varies
Internal
- Micro: Less than 250 active IPs (<25 servers)
  - Basic: $2,000
  - Standard: $3,500
- Small: Less than 750 active IPs (<50 servers)
  - Basic: $2,750
  - Standard: $4,500
- Medium: Less than 2,000 active IPs (<150 servers)
  - Basic: $4,000
  - Standard: $6,500
- Large: Less than 7,500 active IPs (<600 servers)
  - Basic: $6,000
  - Standard: $10,000
- xLarge: More than 7,500 active external IPs
  - Varies

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level
- Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies
remediation testing
- Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies
assist technical support staff with mitigations
- $700 per 5-hr block of consultant time
assist SOC staff in building detections
- $700 per 5-hr block of consultant time
on-site supplemental testing and/or visits:
- mileage fee of $3 per mile from 78006
- plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

< RETURN TO SERVICES PAGE

Web Application Vulnerability Scan

Web Application Vulnerability Scanning is one of our most simplistic services. It offers valuable testing for common vulnerabilities and identifies weaknesses in your web app.

Basic Service

The basic service will run one or more industry standard vulnerability scanners against your web app and deliver the raw report to you for review. Your development team would then review the findings, determine which are potentially false positives, and remediate the remaining issues.

You can review a sample report here: SampleWebAppVulnerabilityScanReport.pdf

Standard Service

The standard service includes everything in the basic service, and, in addition, each finding is verified and a custom Findings and Recommendations Report is created.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

Micro: Apps with less than 12 pages or major functions and 2 user roles (or less)

Basic: $2,350

Standard: $3,750

Small: Apps with less than 25 pages or major functions and 2 user roles (or less)

Basic: $3,500

Standard: $5,500

Medium: Apps with less than 50 pages or major functions and 3-4 user roles

Basic: $4,750

Standard: $7,750

Large: Apps with less than 100 pages or major functions and 4-5 user roles

Basic: $6,500

Standard: $11,000

xLarge: Apps with more than 100 pages or major functions and 6+ user roles

Varies

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

Network Vulnerability Scan

Network Vulnerability Scanning is one of our most simplistic services. It offers valuable testing for common vulnerabilities and identifies weaknesses in your network.

Basic Service

The basic service will run one or more industry standard vulnerability scanners against your network and deliver the raw report to you for review. Your information technology team would then review the findings, determine which are potentially false positives, and remediate the remaining issues.

You can review a sample report here: SampleNetworkVulnerabilityScanReport.pdf

Standard Service

The standard service includes everything in the basic service, and, in addition, each finding is verified and a custom Findings and Recommendations Report is created.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

External

Micro: Less than 12 active IPs

Basic: $1,000

Standard: $2,500

Small: Less than 25 active IPs

Basic: $1,500

Standard: $4,000

Medium: Less than 75 active IPs

Basic: $2,500

Standard: $6,000

Large: Less than 300 active IPs

Basic: $4,500

Standard: $9,000

xLarge: More than 300 active IPs

Varies

Internal

Micro: Less than 250 active IPs (<25 servers)

Basic: $2,000

Standard: $3,500

Small: Less than 750 active IPs (<50 servers)

Basic: $2,750

Standard: $4,500

Medium: Less than 2,000 active IPs (<150 servers)

Basic: $4,000

Standard: $6,500

Large: Less than 7,500 active IPs (<600 servers)

Basic: $6,000

Standard: $10,000

xLarge: More than 7,500 active external IPs

Varies

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

Mobile Application Security Testing

Mobile Application Security Testing tests Android and/or iOS apps. It is typical to perform this in conjunction with Web Application Security Testing when the app is interacting with a webservice/API.

Testing involves automated and manual evaluations of one or more apps to ensure they provide protection against abuse of your data. We use industry standard tools to carry out automated scans looking for well known vulnerabilities, and we also conduct manual testing to find vulnerabilities and attack vectors not otherwise detectable by automated tools.

This is more than a simple vulnerability assessment. We actively attempt to circumvent security controls by carrying out exploits that take advantage of discovered vulnerabilities, revealing what an adversary would be able to do. During testing, we look for any method that can violate the CIA Triad security model (confidentiality, integrity, availability).

Confidentiality is limiting information to only the authorized person(s) who should have access to it.

Integrity is ensuring data/communication at rest or in transit can only originate from, be sent to, or be modified by an authorized person(s).

Availability is the ability for an authorized person(s) to access the resources when needed.

The purpose of testing is to enumerate your exposure (within the given time constraints), identify and verify as many vulnerabilities as possible, ensure the security of your app is strong, and then provide actionable solutions to help you protect against attack/compromise. For example, we use industry standard tools and techniques to look for well known/unpatched vulnerabilities that allow an attacker to gain access to carry out remote code execution, privilege escalation, circumventing intended controls, gain access to sensitive data, etc.

See additional examples
all relevant web app testing techniques and attacks, interaction with web services, security controls are server-side, data storage & privacy, system credential storage facilities, sensitive data in logs, 3rd party app & service interaction, keyboard cache, IPC, backups, backgrounded and locked screen privacy protections, memory analysis, device security policy check & enforcement, strong, modern & properly configured encryption, protocols & algorithms, up-to-date system dependencies and jailbroken checks, minimum permissions requested, webviews, properly signed & provisioned app, decompiling, reverse engineering & trojanizing, non-debuggable build, anti-tampering, device binding, obfuscation, RCE, and more

In most cases, we will leverage the discovered vulnerabilities to (1) verify it is exploitable and (2) determine the exposure, should it be breached. The testing is largely centered around the OWASP Mobile Security Testing Guide, but also includes our internal/proprietary methodologies.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

Micro: Apps with less than 10 major functions and 1 user role – $4,000

Small: Apps with less than 20 major functions and 1 user role – $6,000

Medium: Apps with less than 40 major functions and/or 1-2 user roles – $10,000

Large: Apps with less than 75 major functions and/or 3-4 user roles – $15,000

xLarge: Apps with more than 75 major functions and/or 4+ user roles – Varies

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

Referral Program

$1,000 credit (or $250 cash) for each referral!

It’s simple: tell someone about our services and refer them to us. If they utilize any of our consulting services, you receive a $1,000 credit toward your next testing service with us OR $250 cash…your choice!

Program rules:

Terms

referral – the recommendation itself

referrer – the person/organization making the referral

referee – the person/organization being referred to us

You may refer our services using any legal means: in person, social media, phone call, personal email, etc.

Within 30 days of the referee executing a statement of work (SOW), you will be contacted to arrange credit/payment.

You must choose one reward or the other, not both. You will receive a $1,000 credit toward your next service contract with us OR $250 cash (i.e. electronic transfer, check, etc.).

Credit not to exceed 10% and cash payout not to exceed 5% of SOW.

Although you will receive notification that one of your referrals contracted services with us, we will NOT be able to disclose who it was for privacy reasons. The referee is free to disclose that to you, if they choose, but we are not.

Referral reward is only paid out to the referrer if the referee is a NEW client, not a current/former client of ours.

If two or more referrals are made for the same referee, we will make a good faith effort to determine who made the first referral, and they will receive the reward. Once awarded, other referrals for the same referee will not qualify for the reward.

Additional Information:

The referee must mention your name when they initially contact us.

The referrer does NOT have to be a current/former client of ours or have any previous ties to PEN Consultants.

The referrer should send us their contact information and let us know someone was refereed. This could be as simple as sending the referee an email and CC’ing us.

There are no limits to the number of referrals per referrer or payouts.

Cybersecurity Unlimited

PEN Consultants’ Cybersecurity Unlimited service gives you full access to our entire range of testing, training, staff augmentation, and consulting services at anytime, on-demand. This allows us to form strong partnerships with our clients, meeting your specific organizational needs and maximizing your return on investment.

Contract Details

Number of hours: no minimum

Service Level Agreement (SLA): 24-hr phone/email response time

Any/all of our services, as seen on the services page, can be used – testing, training, staff augmentation, consulting, etc.

Live access to our working notes, hours worked, projected hours, etc.

Client directs/re-directs how every hour is spent

At minimum, quarterly client/consultant meetings

Rates are for labor-only. Travel or other non-standard expenses (specialized equipment, materials, etc.) will be billed separately, if applicable.

Contract length: standard is 12-month

Option A – Pay-As-You-Go

Our standard rate ($175/hr) is billed at the end of each month based on the number of hours incurred for that month.

Option B – Pre-Paid

When agreeing to pre-pay a number of hours per month during the contract period, the hourly rate is discounted as follows:

5+ hrs/month: $168/hr

15+ hrs/month: $160/hr

45+ hrs/month: $153/hr

175 hrs/month: $145/hr

The following additional terms apply:

Monthly payment is due upon contract execution, and pre-paid monthly thereafter, through contract expiration.

If hours are exhausted within a given month, the default, non-discounted, monthly billed rate applies to added hours.

Unused hours may roll over month-2-month, but not past the contract period.

Unused hours at the end of the contract period may be refunded at 50% of the purchase price or unused hours can be rolled over/applied to a new contract.

Multi-year contracts are eligible for the following additional discounts:

2-yr contracts receive an additional 2% discount

3-yr contracts receive an additional 4% discount

Multi-Service Discount

When we perform multiple services for you under a single contract, you will receive a discount for each additional service above the core service. Generally, this is a 20% discount. Example: An external network pentest in conjunction with an email based phishing assessment will grant you a 20% discount on the phishing assessment. Add on an internal network pentest, and you will receive a 20% discount on that service as well.

Discounts are always based on how much overlap there is between services.

Client-Side Application Security Testing

Client-Side Application Security Testing tests “thick” applications that are run and/or installed on an endpoint (workstation, server, etc.). It is typical to perform this in conjunction with Web Application Security Testing when the application is an “agent” running on the endpoint and interacting with a webservice/API.

Testing involves automated and manual evaluations of one or more applications to ensure they provide protection against abuse of your data. We use industry standard tools to carry out automated scans looking for well known vulnerabilities, and we also conduct manual testing to find vulnerabilities and attack vectors not otherwise detectable by automated tools.

This is more than a simple vulnerability assessment. We actively attempt to circumvent security controls by carrying out exploits that take advantage of discovered vulnerabilities, revealing what an adversary would be able to do. During testing, we look for any method that can violate the CIA Triad security model (confidentiality, integrity, availability).

Confidentiality is limiting information to only the authorized person(s) who should have access to it.

Integrity is ensuring data/communication at rest or in transit can only originate from, be sent to, or be modified by an authorized person(s).

Availability is the ability for an authorized person(s) to access the resources when needed.

The purpose of testing is to enumerate your exposure (within the given time constraints), identify and verify as many vulnerabilities as possible, ensure the security of your application is strong, and then provide actionable solutions to help you protect against attack/compromise. For example, we use industry standard tools to scan for and verify well known/unpatched vulnerabilities that allow an attacker to carry out remote code execution, privilege escalation, circumventing intended controls, gain access to sensitive data, etc. In most cases, we will leverage the discovered vulnerabilities to (1) verify it is exploitable and (2) determine the exposure, should it be breached.

The testing is largely centered around static code analysis, fuzzing, and manual analysis using our internal/proprietary methodologies.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

Micro: Plugins, extremely basic applications – $4,000

Small: Single binary, basic/common functionality – $6,000

Medium: Multiple binaries or intermediate functionality – $10,000

Large: Multiple binaries, intermediate/advanced functionality, and unique – $15,000

xLarge: Many binaries, advanced functionality, and unique – Varies

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

Network Security Testing

Network Security Testing (AKA Network Penetration Testing) involves both automated and manual evaluation and testing of your network to ensure it provides protection against abuse of your data. We use a combination of automated industry standard scanning tools to look for well known vulnerabilities as well as conduct extensive manual testing to find vulnerabilities and attack vectors not otherwise detectable by automated tools.

This is more than a simple vulnerability assessment. We actively attempt to circumvent security controls by carrying out exploits that take advantage of discovered vulnerabilities, revealing what an adversary would be able to do. During testing, we look for any method that can violate the CIA Triad security model (confidentiality, integrity, availability).

Confidentiality is limiting information to only the authorized person(s) who should have access to it.

Integrity is ensuring data/communication at rest or in transit can only originate from, be sent to, or be modified by an authorized person(s).

Availability is the ability for an authorized person(s) to access the resources when needed.

The purpose of testing is to enumerate your exposure (within the given time constraints), identify and verify as many vulnerabilities as possible, ensure your security configurations are strong, and then provide actionable solutions to help you protect your organization from attack/compromise. Types of common vulnerabilities found during this testing include those that allow an attacker to gain remote access into your environment, escalate privileges, gain access to your most sensitive data, and exfiltrate it from your network. In most cases, we will leverage the discovered vulnerabilities to (1) verify it is exploitable and (2) determine your exposure, should it be breached.

The testing is largely centered around the PTES, NIST SP 800-115, and OSSTMM testing guides, but also includes our internal/proprietary methodologies. This is “noisy” and may generate alerts in the monitoring solutions you have deployed.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

External

Micro: Less than 12 active IPs – $7,000

Small: Less than 25 active IPs – $9,000

Medium: Less than 75 active IPs – $12,000

Large: Less than 300 active IPs – $18,000

xLarge: More than 300 active IPs – Varies

Internal

Micro: Less than 250 active IPs (<25 servers) – $8,000

Small: Less than 750 active IPs (<50 servers) – $11,000

Medium: Less than 2,000 active IPs (<150 servers) – $15,000

Large: Less than 7,500 active IPs (<600 servers) – $22,000

xLarge: More than 300 active IPs – Varies

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

Wireless Security Testing

Wireless Security Testing involves the assessment of your Wi-Fi infrastructure and wireless clients to ensure there is adequate protection against eavesdropping and unauthorized access. Because the RF (Radio Frequency) signals typically “leak out” of your building and/or campus, an improperly secured infrastructure makes it easy for an adversary to “sniff” your corporate data and possibly even access your corporate network from your parking lot or outside your fence line.

Testing involves performing a wireless site survey, looking for known vulnerabilities, identifying rouge access points, testing various attacks (against the APs and clients), testing isolation controls (especially on guest access APs), examining the configurations of a sample of the wireless clients, reviewing the overall architecture (including physical), etc.

Our testing methodology largely centers around the wireless portions of PTES, SANS‘ Wireless Audit Checklists, and DISA’s wireless security checklist, in addition to our internal/proprietary methodologies.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

Micro: Less than 5 APs and 250 wireless client devices, 1 SSID – $2,750 + Travel

Small: Less than 10 APs and 500 wireless client devices, 2 SSID – $4,500 + Travel

Medium: Less than 25 APs and 1,500 wireless client devices, 3 SSIDs – $6,000 + Travel

Large: Less than 50 APs and 3,000 wireless client devices, 4 SSIDs – $8,000 + Travel

xLarge: More than 50 APs and 3,000 wireless client devices 5+ SSIDs – Varies

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

Red Teaming

Red Teaming has overlap with penetration testing and application security testing, but in addition to testing the technical mitigation aspects of your security stance, it also tests the humans and detection capabilities in your organization.

Red teaming activities range from stealthy recon and penetration of your defense, to working directly with your blue team/SOC. Red teaming falls into two categories: Adversary Simulation and Technique Simulation.

Adversary Simulation

This form of red teaming is an objective driven, stealthy, adversarial simulation which attempts to actively circumvent security controls by carrying out exploits and attack vectors that take advantage of a series of discovered vulnerabilities and/or weaknesses in technical controls, human behavior, process and detection gaps, etc. The red team operation often takes output found during the pentest and/or app testing portion of the engagement, physical attacks and/or social engineering, exploits them, then moves as deep into the network as possible, just like an adversary would.

The objective(s) can include comprising high-value workstations and servers in your network with a persistent backdoor/RAT, gaining access to and exfiltrating your most valuable data, getting domain admin, gaining write access to source code repos, etc. An overarching goal to the specific goal(s) set forth is to avoid getting caught/seen/detected. Once the objective(s) is achieved, assuming we are not caught in the act, we will “get noisy” so your incident responders will see us. This gives them the opportunity to practice the incident response process, including discovery, containment, eradication and recovery.

Adversary Simulation is largely centered around current attacker techniques and campaigns, but also includes the usage of PTES, NIST SP 800-115, and OSSTMM testing guides and our internal/proprietary methodologies.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Technique Simulation

The second category we put red teaming activities into is Technique Simulation, sometimes referred to as “purple teaming”. This type of red teaming gives the best ROI of any security testing service. During this testing, we work closely with your blue team staff while launching individual attacker techniques. We monitor the activities to ensure they are mitigated and/or detected, and if not, help your blue team build the needed capability to do so. This cycle repeats numerous times to cover as many techniques as the engagement scope allows.

Parts of this testing use automated processes, while other techniques require manual methodologies. As such, it is common to run the automated processes first and then perform as many of the manual techniques as the engagement scope allows.

Technique Simulation and the techniques tested are largely centered around the MITRE ATT&CK framework.

Sample Pricing

Because our Red Teaming services are highly tailored to each client engagement, it is not possible to give sample pricing. The following are some of the key criteria in determining the costs for Adversary Simulation:

Small: No dedicated SOC, minimal technical control – basic level engagement

Medium: Basic out-of-the-box security controls, basic security staff – intermediate level engagement

Large: Multi-layered, out-of-the-box security controls, SOC – advanced level engagement

xLarge: Custom security controls, advanced SOC – nation-state level engagement

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

Social Engineering Assessment

As email security filters continue to evolve and improve, attackers are moving from email based phishing to other social engineering methods, such as SMS, phone, in-person impersonation, media drops, etc. These non-email based forms of social engineering rarely have the security solutions in place to monitor and block malicious messages and attacks, which is an advantage for the attacker.

The Social Engineering Assessment could include everything from the Phishing Assessment service (email based social engineering) but could also include a custom tailored combination of SMS (i.e. smishing), phone (i.e. vishing), social media, mailed letters/packages, in-person impersonation (i.e. physical social engineering), media drops, etc. The details of the assessment are tailored to your specific needs and risk profile.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

Because our Social Engineering Assessment services are highly tailored to each client engagement, it is not possible to give sample pricing. The following are some of the key criteria in determining the costs:

Small: No dedicated SOC, minimal technical control

Medium: Basic out-of-the-box security controls, basic security staff

Large: Multi-layered, out-of-the-box security controls, SOC

xLarge: Custom security controls, advanced SOC

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

Phishing Assessment

74% of data breaches start with an attacker sending a phish email to compromise one or more of your systems (source, 2018 Verizon Data Breach Report). Therefore, it is imperative to understand how your defenses measure up to this common, and probable, attack. Unlike other forms of attack, phishing requires an attacker to both exploit the user (ex. social engineering) and bypass security controls (ex. email filtering) to be successful.

PEN Consultants offers Phishing Testing for your organization as part of the Red Teaming Service and Social Engineering Assessment, but we also offer it as a focused and stand alone service, as seen below.

Our semi-automated phishing assessment service provides much more than the typical phish simulation offered by other providers. PEN Consultants, like others, mimics the latest phishing themes and techniques used by attackers to gauge your user’s ability to distinguish between legitimate and varying sophistication levels of phish. But, we don’t stop there. We also include malicious payloads and links to our attacker platforms to see if your technical controls mitigate the risks. If we are successful at both, we take it yet another step and enumerate the systems/data the compromised user(s) have access to.

By executing all three steps, PEN Consultants is able to demonstrate actual likelihood, impact, and unique risks to our Client. This far surpasses the value of simulation testing performed by most providers.

To keep costs low, this is a semi-automated service in which you will provide a list of email addresses, names, and titles for us to target along with technical details of your endpoints and security stack. By eliminating the majority of the recon and testing phases, as compared with a full scope social engineering assessment or red team engagement, and automating the phish deliveries themselves, we can keep expenses substantially lower while maintaining the ability to accurately gauge your risk and the impact of various forms of phishing attacks.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

Small: No dedicated SOC, minimal technical controls, <250 targets

Single Campaign: $1,750

Three Campaigns: $4,000

Medium: Basic out-of-the-box security controls, basic security staff, <1,000 targets

Single Campaign: $2,500

Three Campaigns: $6,000

Large: Multi-layered, out-of-the-box security controls, SOC, <5,000 targets

Single Campaign: $4,000

Three Campaigns: $9,000

xLarge: Custom security controls, advanced SOC, >5,000 targets

Varies

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

On-going quarterly engagements

An organization who wishes to have a certain measure of security will request a one-time testing engagement and may or may not have that repeated on an annual basis. An organization who desires to add an extra level of protection for its data will request an annual testing engagement, followed by a continual quarterly service.

One-time intense testing has advantages and disadvantages. The advantage is that the security tester will be completely focused on your site during the testing. The disadvantage is some real-world attacks require many weeks or months to fully perform, so they will not be completed by the end of a one-time engagement.

The continual quarterly service has several advantages:

Longer attacks can be carried out, which normally would not have time to complete during a one-time testing engagement.

Your network will be evaluated on a continual basis, with most aspects of testing being performed four times within the year.

The latest attacks and n-days will be tested against your organization much more quickly, soon after being made public.

Discount

Annual testing: 10% discount

Semi-annual testing: 20% discount

Quarterly testing: 40% discount

Note: Discount requires an initial full-scope engagement

Nonprofits

PEN Consultants offers a 10% discount on all services to nonprofits – including, but not limited to, nonprofit schools, churches, charities, humanitarian organizations, etc.. Simply Contact us to get started with the nonprofit discounts.

Additionally, we have created a grant program in which individual donors can contribute directly towards the costs of testing services for a particular nonprofit organization.

How it works – For Nonprofits

Contact us so we can discuss the type of service(s) you are looking for.

PEN Consultants will provide you the pricing for the requested services.

You will let us know how much you need covered, even up to the full amount!

A contract will be created that states it is contingent upon your requested grant amount being met.

We will work with you to create a crowdfund campaign profile and get it posted to a reputable crowdfund service.

We will send out notices to all of our registered donors in our mailing list about your testing needs and the need for funding.

We recommend running the campaign for 30-days.

If your goal is met, we start testing! If the goal is not met, you can decide if you would like to make up the difference, or cancel – no obligation!

How it works – For Donors

Submit the form at the bottom of this page to register as a donor.

When a campaign is created, we’ll reach out to you to let you know about it.

If you want to contribute towards the testing, or even cover the entire expense, you can!

For Churches

We are pleased to announce, that because of the generosity of a few of our donors, churches who hold to and teach the Bible being God breathed, inerrant, and infallible, and whose beliefs are consistent with the Apostles’ Creed can expect substantial discounts, based on their average weekly attendance:

Less than 200 attendees – 90% may be donated, leaving just 10% to be covered by the church

200 – 600 attendees – 70% may be donated

600 – 1,200 attendees – 50% may be donated

More than 1,200 attendees – 30% may be donated

Donor Sign-up – Register for Notifications

Name or Organization *
Email Address *
Phone Number
Other Contact Method
Note
Name

* nonprofit, as defined and approved by IRS, HMRC, etc.

Web Application Security Testing

Web Application Security Testing (AKA Web App Penetration Testing) involves automated and manual evaluation and testing of one or more applications to ensure they provide protection against abuse of your data. We use a combination of automated industry standard scanning tools to look for well known vulnerabilities as well as conduct extensive manual testing to find vulnerabilities and attack vectors not otherwise detectable by automated tools.

This is more than a simple vulnerability assessment. We actively attempt to circumvent security controls by carrying out exploits that take advantage of discovered vulnerabilities, revealing what an adversary would be able to do. During testing, we look for any method that can violate the CIA Triad security model (confidentiality, integrity, availability).

Confidentiality is limiting information to only the authorized person(s) who should have access to it.

Integrity is ensuring data/communication at rest or in transit can only originate from, be sent to, or be modified by an authorized person(s).

Availability is the ability for an authorized person(s) to access the resources when needed.

The purpose of testing is to enumerate your exposure (within the given time constraints), identify and verify as many vulnerabilities as possible, ensure your security configurations are strong, and then provide actionable solutions to help you protect your organization from attack/compromise. Types of common vulnerabilities found during this testing include those that allow an attacker to carry out remote code execution, DoS, SQLi, XSS, Directory traversal, privilege escalation, etc.

See additional examples
static and dynamic vulnerability analysis, information gathering through OSInt and public research, configuration management, temp files, logs, network & infrastructure configuration, HTTP methods, HTTP headers (ex. HSTS, CORS, XSS, X-frame, etc.), identity management, user registration & account provisioning process, account enumeration & guessable user accounts, authentication & authorization, brute-force, authentication bypass, privilege escalation, 2FA/MFA, cache weakness, password policy, directory traversal, insecure direct object references, secure session management, session timeout & logout, session fixation, CSRF, session control, puzzling & hijacking, input & data validation, sanitization, & format string attacks, XSS, SQL, command, & other forms of injection, SSRF, file inclusion, buffer, heap, & stack overflow, error handling, cryptography, secure data at rest (ex. local store), in use (ex. IPC) and in transit (ex. SSL/TLS), secure network communications, certificate trusts, protocols, ciphers, protocols, etc., MiTM attacks, risky business functions and logic, file uploads, process timing attacks, reverse engineering, user accessible logs and alerts for authentication history, password resets, account changes, account lockout, etc., DoS, and more

In most cases, we will leverage the discovered vulnerabilities to (1) verify it is exploitable and (2) determine your exposure, should it be breached. The testing is largely centered around the OWASP testing guide, but also includes our internal/proprietary methodologies. This is “noisy” and may generate alerts in the monitoring solutions you have deployed.

View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.

Sample Pricing

Micro: Apps with less than 12 pages or major functions and 2 user roles (or less) – $6,500

Small: Apps with less than 25 pages or major functions and 2 user roles (or less) – $9,500

Medium: Apps with less than 50 pages or major functions and 3-4 user roles – $12,000

Large: Apps with less than 100 pages or major functions and 4-5 user roles – $16,500

xLarge: Apps with more than 100 pages or major functions and 6+ user roles – Varies

Add-On Services

In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:

post-testing briefings – executive level and/or technical level

Micro: $275 each, Small: $350 each, Medium: $450 each, Large: $525 each, xLarge: varies

remediation testing

Micro: $450, Small: $525, Medium: $625, Large: $700, xLarge: varies

assist technical support staff with mitigations

$700 per 5-hr block of consultant time

assist SOC staff in building detections

$700 per 5-hr block of consultant time

on-site supplemental testing and/or visits:

mileage fee of $3 per mile from 78006

plus, $250-400 per day for most visits

DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).

DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.

© PEN Consultants, LLC 2013 -

< RETURN TO SERVICES PAGE

Basic Service

Standard Service

Sample Pricing

Add-On Services

< RETURN TO SERVICES PAGE

Contact Us