PT/01 · Penetration testing
How far would an attacker get?
Testing from the internet, from inside your network and across Microsoft 365, where most small-business breaches actually happen.
01Overview
What we look at.
From the outside, we look at everything your business exposes to the internet, including the systems nobody remembers are still online. From the inside, we see how far one compromised laptop could take an attacker.
Your Microsoft 365 accounts get the same treatment. The result is a clear picture of your real exposure and the most efficient way to close it.
In scope
- Everything you expose to the internet
- Your internal network, starting from a single compromised device
- Microsoft 365 accounts, sign-in and access settings
- Separation between sensitive and general networks
- Wireless networks, on site
02Why test
What you get out of it.
See what an attacker sees
An outside view of your exposure, including the forgotten systems that tend to be the way in.
Break the path to control
Most serious compromises follow a short chain of steps. We show you the chain and the cheapest place to break it.
Meet compliance and insurer requirements
Payment card standards require regular testing, and cyber insurers increasingly ask for it.
Fix in the right order
Findings are ranked by real business risk, so your budget goes where it counts.
Ground rules
- Nothing that could take systems offline
- Anything we add is documented and removed at the end
- If anything looks unstable, we stop and call you
03Included
Every engagement includes.
See a sample reportA clear, written report
A summary for leadership, then each finding with evidence, a severity rating and a fix your team can act on.
Critical findings, same day
If we find something critical, we call you that day instead of waiting for the report.
Retest included
Once fixes are in, we retest at no extra cost and update the report with what's closed.
Attestation letter
A one-page summary of scope, dates and outcome for customers, auditors and insurers.
Readout call
We walk your team through the results and agree what to fix first.
Your data, handled carefully
Test evidence stays encrypted and is deleted after the retest unless you ask us to keep it.
04FAQ
Common questions.
How long does a network test take?
An external test usually takes about a week. Internal and Microsoft 365 testing takes one to two weeks, depending on the size of your environment. The report follows within a week.
What does a network test cost?
Every test gets a fixed quote after a free scoping call, based on what's actually in scope. No hourly billing and no surprises on the invoice.
Isn't this just a vulnerability scan?
No. A scan lists known weaknesses, with plenty of false alarms. A penetration test shows what an attacker could actually reach, and reports only what was proven.
Do you need to be on site?
Usually not. Most testing is done remotely. We're based in Solvang, so on-site work such as wireless testing is easy to arrange on the Central Coast.
Should we tell our IT provider?
Your call. If they know, the test focuses on finding weaknesses. If they don't, it also shows whether anyone notices. Either way, a named contact on your side knows it's happening.
Could testing break something?
We avoid anything that could take systems offline, coordinate anything sensitive with you first, and stop and call if anything looks unstable.
Other testing
PT/02
Web application testing
Your customer portals, web apps and integrations, tested by people trying to make them do what they shouldn't.
PT/03
Social engineering
Realistic phishing, phone and text campaigns that show how your team responds, followed by training aimed at what worked.
PT/04
AI system testing
The chatbots, copilots and AI assistants you've deployed, tested for what they could be talked into revealing or doing.
Next step
Scope your test.
You'll speak with the person who does the testing. We reply within one business day.