Objective, independent penetration testing and vulnerability auditing for external perimeters, web portals, and internal networks. Backed by 26+ years of enterprise systems engineering and SOC 2 program experience.
Methodology
CVSS v3.1 / NIST 800-115
Tooling Standards
Tenable Nessus Pro + Custom Vectors
Professional Coverage
$2M Aggregate / $1M Per Claim Tech E&O
Data Destruction
14-Day Mandatory Cache Purge
Perimeter auditing and exploitation testing across internet-facing IP addresses, hostnames, and web assets.
Automated perimeter CVE discovery, open port mapping, unpatched service detection, and SSL/TLS cipher review.
Full EVA scope + automated credential exploitation, THC Hydra administrative dictionary probes, and manual exploit verification.
Internal engagements include remote drop-box or VM provisioning and cover twice the host count of the external services.
Authenticated internal scanning across LANs/VLANs. Uncovers legacy OS instances, missing security patches, and weak local services.
Assumed-breach internal simulation: LLMNR/NBT-NS broadcast poisoning, SMB signing audits, and Active Directory attack paths.
Additional scope: $895 per additional block of 25 public IPs or FQDNs (external). $795 per additional block of 25 active internal hosts (internal). Quoted and approved in writing before any additional testing. Internal hosts are discovered within an enumerated range of up to 1,024 addresses (four /24 subnets or equivalent); each additional internal block extends that range by one /24.
Validate patched vulnerabilities on designated assets without contracting a full assessment.
• The External Vulnerability Assessment includes up to 1 hour of post-engagement consultation. All other services include up to 2 hours.
• Additional advisory support and audit defense are billed at $245.00/hour in 15-minute increments.
Need recurring assessments for SOC 2, PCI-DSS, or cyber insurance renewals? We provide structured 2×/year and 4×/year cadences with automated pre-scan scope verification and volume pricing.
No scanning occurs without a signed Rules of Engagement (RoE) confirming target asset ownership, explicit boundaries, and designated maintenance windows.
Credential sprays are strictly rate-limited to avoid triggering lockout thresholds. Scans avoid destructive payloads to maintain production uptime.
Deliverables eliminate automated scanner noise, pairing technical vulnerability metrics with prioritized, practical remediation roadmaps.
Contact our security engineering team to confirm target endpoint blocks, review testing windows, and receive a formal Rules of Engagement document.