Penetration Testing & Managed Compliance

A vulnerability scan is automated: it lists known weaknesses it can detect, and it runs continuously as part of our cybersecurity service. A penetration test is a person actively trying to break in - chaining small weaknesses together, abusing misconfigurations, and finding out what an attacker could actually reach. Scans tell you what might be wrong. A pen test tells you what an intruder could do with it.

Because we are about to become responsible for the environment, and we would rather know what is in it than inherit surprises. Onboarding tests regularly turn up old admin accounts, remote access tools nobody remembers installing, and services exposed to the internet by a previous provider. It also gives you a baseline, so later tests show measurable progress.

At minimum once a year and after any significant change - a new office, a firewall replacement, a major cloud migration. PCI DSS requires exactly that, and most cyber insurers and auditors expect it. Higher-risk environments benefit from testing more often. We set the cadence with you based on your risk and your framework, and write it into your plan.

It should not. Every test runs under written rules of engagement that define scope, timing, and what is off limits. We do not run denial-of-service attacks against production systems, and anything with a realistic chance of disruption is scheduled for an agreed window with you informed in advance.

No, and you should be wary of any IT provider that says it can. A SOC 2 report is issued by a licensed CPA firm, PCI DSS assessments are performed by a Qualified Security Assessor, and CMMC certification comes from an accredited C3PAO. What we do is the work that decides how those assessments go: implement the controls, write the policies, collect the evidence, run the risk assessments, and sit alongside you when the assessor asks questions.

Most compliance evidence comes from systems we already manage: patching, MFA, backups, endpoint protection, and user access. We capture that evidence continuously instead of reconstructing it once a year, run risk assessments on a schedule, update policies when the environment changes, and review where you stand with you regularly. We are also building our own compliance platform through Parliament Labs, our software team, to make that evidence trail easier to see.

No. We run scoped, authorized penetration tests for businesses that are not managed clients, whether you have internal IT, another provider, or need an independent test for an auditor or insurer. You get the same written rules of engagement, the same risk-ranked report, and a retest once the findings are fixed. There is no obligation to move your IT to us afterward.

Only the people you name in the rules of engagement. A pen test report is effectively a map of how to break into your business, so we treat it that way: it is shared with your designated contacts, not a general inbox, and it is not used for anything other than securing your environment.

For managed IT clients, the baseline test is part of onboarding and ongoing testing and compliance support are built into the plan we scope with you. Standalone pen test pricing depends on what is in scope - external addresses, internal systems, wireless networks, and whether we test on site - so every engagement is scoped first and you get a written, fixed quote rather than a number that changes halfway through.