Manual Penetration Testing Services with a Free Retest

A penetration test, also known as pen test services or ethical hacking, is a simulated cyberattack that helps organizations detect and highlight weaknesses and vulnerabilities in their security postures. This proactive cybersecurity technique allows business owners to assess the hackability of their networks, systems, processes, and people and take the necessary actions to prevent that.

Vulnerability assessment is the technique used to identify, classify, and prioritize issues in infrastructures, apps, and systems. It is usually conducted using automated testing tools, including network vulnerability scanners.

Penetration testing goes a step further. Ethical hackers manually exploit what the scan finds, chain weaknesses together, and show how far an attacker could get. Many teams scan continuously and run a penetration test at least once a year or after major changes.

Both, with the weight on manual work. Our pentesters run automated scanners at the start for coverage, then do the core work by hand: they verify each finding, rule out false positives, exploit what's real, and chain weaknesses the way an attacker would. Access-control gaps and business-logic flaws rarely show up in a scan, which is why every UnderDefense engagement includes manual testing by certified ethical hackers (CEH, OSCP, OSCE).

Every UnderDefense report has an executive summary for leadership and a technical section for your IT team. Each finding comes with its risk level, proof of exploitation with screenshots or video, steps to reproduce it, and remediation guidance. After the free retest, you also get a letter of attestation that confirms the scope, the results, and your overall security rating.

PCI DSS v4.0.1 (Requirement 11.4) requires internal and external penetration testing at least once every 12 months and after any significant change. SOC 2 and ISO 27001 don't prescribe a pentest, but auditors often ask for one as evidence that your controls work. Under DORA, financial entities named by their regulator run threat-led penetration testing every three years. Every UnderDefense engagement ends with a report and a letter of attestation you can hand to your auditor for ISO 27001, SOC 2, PCI DSS, or HIPAA.

We test external and internal networks, web and mobile applications, APIs, cloud environments, IoT devices, and wireless networks, and we test people through social engineering. For a full attack simulation across people, processes, and technology, we run red team engagements. Each test can run as a black box, gray box, or white box engagement, and cloud penetration testing has its own dedicated page.

Cost depends on the type of test, the scope (the number of IPs, applications, and cloud accounts), and the testing approach (black, gray, or white box). Engagements start at $5,000 for an external perimeter test, and our pentest pricing page shows what each tier includes. For an exact figure, share your scope and we'll send a free quote.

On average, cyber security testing services take around 3 working weeks, depending on the size and complexity of an organization. A typical timeline for a pentest includes the following stages:

1. Planning. Together with you, we define and document test objectives, scope of work, start date, and engagement model for the pen test as a service team.


2. Reconnaissance. Depending on the selected pen testing as a service methodology, we collect the necessary information regarding targeted apps and infrastructure, roles, credentials, business logic, and more.


3. Vulnerability discovery and exploitation. Our ethical hackers manually test the defined assets to identify security weaknesses, gaps in design and architecture, and process loopholes. They exploit all the discovered vulnerabilities to evaluate the risk level of each issue and potential harm to the business.


4. Reporting. The UnderDefense pen testing team creates a detailed report on all the findings, including all the evidence and artifacts like videos and screenshots. Additionally, our experts prepare a list of tactical recommendations on how to solve each vulnerability quickly and effectively. The working results are presented to the client.


5. Free post-remediation testing. When all the improvements and changes are made, our ethical hackers are ready to check fixed vulnerabilities and retest the targeted assets. Upon completing the assessment, you get a professional attestation letter confirming your security rating.

We recommend performing pen tests at least once a year. However, you should also take into account the following factors:

• Regulatory Requirements – Compliance standards like PCI DSS, ISO 27001, and SOC 2 may require more frequent testing.
• Significant Changes – Conduct a test after major infrastructure, application, or system updates.
• Incident Response – If a security breach occurs, a pen test can help identify vulnerabilities that were exploited.
• Business Risk – High-risk industries or businesses handling sensitive data may need more frequent testing.
• Threat Landscape – Emerging threats may necessitate additional assessments to stay ahead of attackers.

UnderDefense offers a flexible business approach that depends on the specific situation. We encourage you to contact our sales representatives and discuss how quickly you need us to get started.

We follow proven and globally recognized methodologies like the Penetration Testing Execution Standard (PTES), OWASP Top 10 Web Application Security Risks, OWASP Web Security Testing Guide, and the Open Source Security Testing Methodology Manual (OSSTMM).

We send you the testing results via an encrypted channel and do not collect or store the results after that.