Penetration testing guides for US teams
Practical reading for the US teams who buy, run and act on penetration tests, from PCI DSS planning to insurance renewals.
Rules, renewals and the tests behind them
Where US card rules and insurance questionnaires meet the penetration test you buy.
PCI DSS v4.0.1 penetration testing
Requirement 11.4 in plain terms: annual internal and external tests, segmentation checks, who may test and how retests work.
Read guidePentests and cyber insurance applications
How test results help you answer questions on MFA, patching, backups and EDR, and fix gaps before renewal.
Read guideDecide what, how and when
Settle the scope, the level of tester access, the calendar and the cadence before you compare proposals.
Scoping a penetration test
A worksheet for turning an audit deadline or customer request into countable targets and clear limits.
Read guideBlack, gray or white box testing
How much to tell your testers, and why sharing accounts and documents usually buys more findings per day.
Read guideHow long a pentest takes
Tester-days by target type, plus the lead time, reporting and time-zone planning around them.
Read guideHow often to pentest
Annual floors set by US rules, and the change triggers that should prompt a test in between.
Read guideChoose the right provider and model
Compare bids on substance and decide where a bounty program fits.
For the engineers preparing the environment
Where testers start in two common targets, and what to have ready.
Turn findings into closed issues
Read severity scores sensibly, then fix, verify and keep the proof.
Ready to find your risks before attackers do?
Tell us what you need tested or monitored. A senior consultant replies within one business day with a scoped, fixed-price proposal.
- Fixed-price proposal
- Reply within 1 business day
- NDA on request