Frequently Asked Questions
Whether you’re scoping your first test or comparing vendors, you can start here.
These are the questions we hear most from teams like yours, answered plainly by the consultants who do the work.
What is a Penetration Test and why is it important?What is Penetration Testing?
A penetration test simulates attacks on your systems to identify vulnerabilities and potential entry points before malicious actors can exploit them. Unlike an external threat actor, a penetration tester is performing tests with your explicit permission, and reporting all findings directly to your security team to fix.
Penetration testing helps organizations proactively reduce risk, comply with regulatory requirements, such as the Payment Card Industry Data Security Standard (PCI DSS), the US Health Insurance Portability and Accountability Act (HIPAA), the US Gramm-Leach-Bliley Act (GLBA), or the EU’s Digital Operational Resilience Act (DORA), assess security control effectiveness, and protect critical assets like customer data and intellectual property. Effective testing requires comprehensive coverage, experienced professionals, and risk-focused analysis rather than automated scanning alone.
Why do I need a penetration test?What is Penetration Testing?
You cannot fix what you cannot see. During testing, vulnerabilities can be systematically identified and documented. This allows you to implement remediations that can strengthen your overall defenses, help prevent breaches, and ease the path to compliance with today’s data protection laws.
A penetration test shows that an organization is proactively securing digital assets and data against malicious intrusion. Some regulatory compliance frameworks also require organizations to have penetration testing performed.
What’s the difference between penetration testing and vulnerability scanning?What is Penetration Testing?
Penetration testing actively simulates attacks to exploit vulnerabilities and assess real security posture, with a person mimicking attacker behavior. A penetration tester performs specific tests against the assets and devices they identify in your network, and attempt to bypass security controls using real-world attack techniques.
By comparison, vulnerability scanning is a passive activity. Vulnerability scans are automated tools that compare your systems against databases of documented or known issues. Scanning should happen regularly as a baseline, but it lacks the context a real assessment needs on its own.
How long does it take to do a penetration test?What is Penetration Testing?
This depends on the scope of a given engagement. Active testing typically runs three to ten days depending on scope. The full engagement, including pre-engagement work and reporting, usually spans two to four weeks.
How often does my organization need a penetration test?What is Penetration Testing?
In most cases, annually, or whenever a significant change occurs to a system or application. Specific requirements vary by regulation, internal policy, and the scope of a given engagement.
What is the Penetration Testing process?What is Penetration Testing?
The penetration testing process includes three phases:
- Before testing, we conduct scoping calls to define objectives and develop a customized Statement of Work (SoW).
- During testing, we follow relevant testing methodologies specific to your test type, maintain regular communication, and provide 24/7 availability for concerns. At this point, the team follows an existing penetration testing methodology, such as Penetration Test Execution Standard (PTES), which includes the following stages:
- Threat Modeling: Testers create a model that covers your assets and potential threats.
- Reconnaissance: Testers review your reachable assets and public data.
- Vulnerability Discovery: Testers attempt to identify vulnerabilities on the identified assets.
- Exploitation: Testers attempt to exploit the identified vulnerabilities.
- Post-exploitation: Testers attempt to expand their access from previous exploitation.
- After testing, we deliver a draft report for review, schedule an optional debrief call, and finalize findings with actionable recommendations.
How do I prepare for a Penetration Test?What is Penetration Testing?
There are key steps your team can take to ensure you are properly prepared, which ensures that testing starts on schedule and maximizes value. These requirements should be completed before the start of testing, and include:
- Provisioning multiple user accounts for different roles
- Ensuring code stability (it should pass QA first)
- Whitelisting tester IPs in perimeter controls when appropriate
- Providing necessary testing assets like application binaries or API documentation
Plan for administrative tasks like VPN access and change windows at least a week in advance. Clear communication through a kickoff call helps identify potential delays before they impact testing quality or timeline.
How much does a Penetration Test cost?What is Penetration Testing?
Most penetration tests range from $10,000 to $45,000, depending on scope (type, breadth, and depth of testing) and the vendor’s hourly rate ($200-$500/hr). A single web application typically costs less than comprehensive internal and external network testing. Factors like compliance requirements, after-hours testing, and retesting affect pricing. Control costs by clearly defining scope, providing detailed information upfront, and bundling multiple tests.
What is the scope of a pentest?Homepage
The scope defines which systems, applications, or environments are included in a pentest, and how deep the testing goes on each asset. We can set the scope as narrow as a single web app, or as broadly as your entire external network. We typically set the scope during a scoping call, where a consultant works with you to prioritize your highest-risk assets, keep testing efficient, and avoid disrupting production systems.
How soon can we schedule a test?Homepage
Once a contract is signed and all agreements are finalized, we can typically schedule a test between two and four weeks out. Timing depends on consultant availability and how quickly scoping and contracting move, which means that starting the conversation early (ideally months ahead of a compliance deadline) helps avoid last-minute scrambling.
What is the Secure Ideas engagement process?Consulting & Advisory
Our engagement process follows these stages:
- Scoping – effort estimation via consultation
- Contracting – Master Service Agreement and Statement of Work
- Scheduling – We coordinate schedules with you and our testers, typically plan for six weeks out
- Kick-off call – Occurs two weeks before testing to review scope and logistics
- Execution – testing performed over one to two weeks for most tests
- Draft report delivery – two to five business days post-testing with rigorous internal review
- Finalization – incorporating your feedback over a two-week review period
We also maintain clear communication, and report at defined milestones to ensure smooth collaboration throughout the engagement.
What Sets Secure Ideas Apart From Other Security Consulting Firms?Consulting & Advisory
Secure Ideas focuses our consulting practices on improving the security industry through education and advice. We want to help you grow your security function. Our goal with each engagement is to leave our clients with not only the answers they need, but tangible and practical techniques and tools they can put into practice until the next time we work with them.
To back that up, Secure Ideas brings over 170 years of combined consultant experience across system administration, network architecture, and application development. Our team has tested everything from government agencies to Fortune 50 companies, with expertise spanning multiple industries including healthcare, financial services, energy, and government. We contribute to open-source security projects, present at major industry conferences, and provide practical, actionable recommendations based on real-world operational experience. Our focus is delivering the best penetration testing experience through expert collaboration and unbiased consultation.
Where do I start with security testing?Consulting & Advisory
The right starting point depends on your security program maturity and requirements. The key is matching the assessment type to your current security posture and objectives.
If you have specific compliance requirements mandating penetration tests or audits, start there.
We recommend that organizations just beginning their security journey start with a gap analysis to identify control deficiencies, followed by vulnerability assessments, and later penetration testing.
Those with existing security programs may benefit most from security assessments, including cooperative reviews of controls and policies, before penetration testing.
How are security findings risk-ranked?Consulting & Advisory
Findings are ranked as Critical, High, Medium, or Low based on consultant expertise and three key factors: potential threats (attacker type and required expertise), likelihood of attack (motivation, complexity, and existing controls), and possible impact on the organization.
We use qualitative assessment rather than complex scoring formulas because those quantitative methodologies still rely on estimations and opinions: Critical-severity findings involve active exploitation requiring immediate attention, while Low-severity findings provide limited risk alone but may contribute to larger attacks when combined with other vulnerabilities.
How can I lower my cyber insurance costs?Consulting & Advisory
Cyber insurance premiums are based on risk profiles that consider factors like industry, data sensitivity, revenue, and security controls. Regular penetration testing and security assessments demonstrate proactive risk management, which can significantly reduce insurance costs. Organizations that conduct regular testing, implement strong security controls, and address vulnerabilities before incidents occur present lower risk profiles to insurers.
Our PETaaS® offering provides continuous testing access and expert consulting to help maintain strong security posture, directly impacting insurance premiums while reducing breach risk.
What are the ethical and legal considerations for Penetration Testing?What is Penetration Testing?
Penetration testing requires explicit authorization, clear documentation of scope, and strict confidentiality protocols. Testers must be transparent about their methods and ensure testing doesn’t harm systems or stakeholders. Organizations must comply with regulations like the US Computer Fraud and Abuse Act (CFAA), US Electronic Communications Privacy Act (ECPA), and EU General Data Protection Regulation (GDPR), maintain detailed testing records, and work with qualified professionals to mitigate liability. Proper planning ensures testing is both effective and responsible.
What are the risks of a Penetration Test?Penetration Testing
Penetration testing carries inherent risks including potential system outages, inadvertent exposure of sensitive data, masking of real attacks, and temporary productivity loss. The biggest risk factors stem from inexperienced testers or unexpected system behaviors. Choosing an experienced, reputable testing partner with clear communication protocols and rules of engagement significantly minimizes these risks while maximizing the value of your security assessment.
What’s the difference between API and Web Application Pentests?What is Penetration Testing?
A web application penetration test examines the application as users interact with it, including browser-based vulnerabilities and the API calls the application makes. An API penetration test focuses on the backend logic, authorization, and authentication mechanisms of the API itself. Since web applications often use only a small portion of an API’s total functionality, testing just the web app can leave significant API vulnerabilities unexamined. Organizations relying on internal or third-party APIs need testing that covers both layers.
Read More About The Difference Between Web App and API Pentests Here ›
How is my data protected during and after Penetration Testing?What is Penetration Testing?
Reputable penetration testing firms protect your data through three core principles:
- Discretion in what data is accessed and how
- Secure transmission and storage using encrypted channels and AES-256 encryption at rest
- Strict retention policies that destroy test artifacts shortly after report finalization.
Testers exercise judgment to minimize unnecessary data collection, using screenshots and redaction when possible. All data handling follows responsible security practices, with customizable retention periods available to meet your operational or regulatory requirements.
Can we see a sample report from a Penetration Test?Multiple Pages
Absolutely. Any reputable penetration testing company should provide sample reports upon request. Reports are your primary deliverable and should include an executive summary, testing narrative, detailed findings with risk ratings, replication steps for verification, and actionable remediation recommendations. Not all reports are created equal, so reviewing samples helps ensure the format and content meet your needs. Most companies will accommodate reasonable modifications to reporting formats.
What is Professionally Evil Testing as a Service (PETaaS®)?PETaaS®
PETaaS® provides continuous access to penetration testing expertise rather than one-time assessments. This approach offers on-demand or scheduled testing, integrates with your software development lifecycle, and delivers regular vulnerability analysis with ongoing support. While initially appearing more expensive than traditional testing, PETaaS® is significantly more cost-effective than hiring full-time security staff and provides proactive, real-time vulnerability identification. The industry lacks a standard definition for penetration testing as a service, so verify that your provider’s approach aligns with your expectations.
What is a PETaaS® credit?PETaaS®
One credit is equivalent to up to one full day of Secure Ideas consultant effort. Credits can be applied toward any type of penetration testing engagement, including web application, network, API, cloud, and mobile assessments.
How do I schedule a test with credits?PETaaS®
Once your credits are purchased and your MSA is signed, reach out to our team through Slack, email, or the client portal. We will work with you to scope the engagement, determine the credit allocation, and schedule testing. No additional contracts or procurement steps required.
How long are credits valid?PETaaS®
Credits are valid for two years from the start of the contract.
What types of testing can I use credits for?PETaaS®
Credits can be applied to any testing type Secure Ideas offers, including web application penetration testing, network penetration testing, API assessments, cloud security assessments, mobile application testing, and more. Your advisory team can help determine the right allocation for your needs.
What does advisory access include?PETaaS®
Advisory access provides direct communication with Secure Ideas consultants through Slack, email, video calls, and our portal. You can ask security questions, get guidance on technology decisions, discuss findings from previous tests, and receive support navigating compliance requirements. Most inquiries receive same-day responses.
How is PETaaS® different from automated PTaaS platforms?PETaaS®
Automated platforms run scanners on a schedule and present the results. PETaaS® delivers manual testing performed by experienced human consultants who understand attack paths, business context, and how vulnerabilities chain together. We identify how attackers actually compromise environments, not just which CVEs are present.
Does PETaaS® meet PCI DSS 4.0 continuous testing requirements?PETaaS®
Yes. PETaaS was designed with evolving compliance requirements in mind, including PCI DSS 4.0’s shift toward continuous security validation. Our Continuous Penetration Testing tier provides monthly testing over 12 months, delivering the ongoing human-led validation and documentation that QSAs expect.
Can PETaaS® integrate into our SDLC?PETaaS®
Absolutely. Credits can be allocated to test features within specific epics or releases, allowing you to embed real penetration testing into your development workflow. This catches vulnerabilities before they reach production, reducing the cost and risk of post-deployment remediation.
Is continuous testing more expensive than an annual pentest?Continuous Pentesting
The overall cost depends on scope and cadence. Because continuous testing is scoped based on overall effort, and combined internal/external engagements are scoped together, costs for continuous testing are often more predictable over a year than a single large annual engagement plus any emergency retesting would be.
Does continuous testing replace manual penetration testing entirely?Continuous Pentesting
No. Continuous testing fills the space between deeper, fully manual engagements. Complex applications and specific compliance milestones can still benefit from focused, manual testing. Continuous testing focuses on the changes to an app or environment over time, while annual testing can provide a deeper and more holistic view into the same assets.
How often does testing actually happen in a continuous pentesting cycle?Continuous Pentesting
The cadence mostly depends on your industry, regulatory requirements, and how frequently your environment changes. During scoping, we build the testing cadence around your risk profile, relevant regulations, and company requirements, not a fixed template.
Does continuous testing help with cyber insurance renewals?Continuous Pentesting
Yes. Every test in a continuous pentesting cycle generates documentation that shows active, ongoing risk management, which is increasingly what carriers ask for at renewal.
What industries is continuous testing most relevant for?Continuous Pentesting
Continuous testing is a direction that many industries with strict regulatory compliance requirements. For example, finance, healthcare, and payment processing all have testing requirements that are moving toward continuous or semi-annual cadences.
Additionally, fast-moving development teams outside regulated industries can benefit just as much from the coverage. Organizations that deploy code on a daily, weekly, or even monthly basis may find that the annual cadence does not provide enough visibility into their most sensitive assets.
What does TLPT stand for?Threat-Led Pentesting
Threat-Led Penetration Testing. TLPT is a structured, intelligence-driven security assessment that simulates real-world attacks against an organization’s live production systems. Rather than following a standardized testing process, TLPT engagements start with threat intelligence reports relevant to an organization’s industry, maturity, geography, and specific threat landscape.
Is TLPT required by law?Threat-Led Pentesting
For certain financial entities under the EU’s Digital Operational Resilience Act (DORA), yes. DORA requires qualifying entities to perform TLPT at least every three years.
Organizations outside of the EU that provide service to EU residents, operate in the EU, or provide ICT services to EU entities may also be subject to DORA and its TLPT requirements. Consult a legal expert to determine whether it applies to your organization.
While there is no current US law requiring TLPT, regulations may shift in the future toward more continuous and threat-led pentesting practices.
How is TLPT different from a regular pentest?Threat-Led Pentesting
TLPT engagements are driven by specific threat intelligence, and has a broader scope, as it covers the entire organization. Testing is conducted covertly (except for a control group in the organization), and includes mandatory purple teaming.
Traditional pentesting focuses on specific systems or applications, based on a pre-determined scope. Stakeholders are aware of the test, and no purple team component is required.
How long does a TLPT take?Threat-Led Pentesting
The full lifecycle, from preparation through remediation, can span several months. The red team execution phase alone can take three to four months.
By contrast, a typical pentest engagement lasts from a few days to two weeks.
Can internal teams perform TLPT?Threat-Led Pentesting
Under DORA, yes, with conditions. The threat intelligence provider must be external to the company, and internal testers must meet qualification requirements. Additionally, every third TLPT cycle must use an external red team.
What is the relationship between TLPT and TIBER-EU?Threat-Led Pentesting
DORA’s TLPT requirements were developed in accordance with the TIBER-EU framework. The two have been aligned, and in practice TIBER-EU can be used to fulfill DORA TLPT requirements.
Does Secure Ideas perform TLPT?Threat-Led Pentesting
Yes. Our team has extensive experience in red teaming and adversary simulation. We work with organizations to plan and execute TLPT engagements tailored to their specific threat landscape and regulatory requirements.
What happens after the TLPT?Threat-Led Pentesting
The red team testers work with the company’s blue team to conduct a purple teaming exercise. The control team coordinates remediations, and a final report is produced. The supervising authority may issue a formal attestation.
Is purple teaming the same as a tabletop exercise?Purple Team Pentesting
No. Although the two are related.
A tabletop exercise walks your team through a hypothetical incident on paper, everyone talking through what they’d do.
Purple teaming replaces the hypothetical with an actual, live technique running against your real systems. This means that your team is using their real tools and real procedures against real attack patterns, instead of the security team reading and describing what they could do, in theory.
Is purple teaming a replacement for a red team engagement?Purple Team Pentesting
No. Purple teaming is more targeted and collaborative, and focuses on specific controls and detection capabilities.
A full red team engagement still has a place for organizations that want a broad, covert simulation of a real attacker with no advance warning to defenders.
Do we need an internal blue team to do purple teaming?Purple Team Pentesting
Yes, in some form. Purple teaming requires defenders. Whether that’s a dedicated SOC, a handful of IT staff wearing a security hat, or an internal red team collaborating with outside testers.
We build the exercise around your existing detection and response capability, whatever shape that currently takes.
How is purple teaming different from a standard pentest?Purple Team Pentesting
A standard pentest focuses on finding and reporting vulnerabilities based on a pre-defined scope, and typically occurs without the active involvement of your security team.
Purple teaming is a collaborative exercise that focuses on whether your team can detect and respond to an active attack, using the test itself as a live training exercise for defenders.
How often should we run a purple team exercise?Purple Team Pentesting
That depends on how much your environment and tooling change. For organizations investing heavily in new detection capabilities, they may benefit from more frequent engagements to validate that investment as it’s built out. Organizations with a more mature detection and response function that changes less may benefit more from a red team exercise.
How is red teaming different from a penetration test, in one sentence?Red Team Pentesting
Where pentest determines whether a specific system has exploitable vulnerabilities, a red team engagement asks whether a real adversary could achieve a specific objective across the whole organization, undetected.
Will our own security team know the test is happening?Red Team Pentesting
Generally no, and that’s intentional. Often, only a small trusted agent group, typically the CISO or an executive sponsor, is informed. The value of the engagement depends on testing genuine, and works best with unrehearsed detection and response.
Does red teaming include physical security testing?Red Team Pentesting
It can, depending on the scope. Physical engagements carry unique legal and coordination requirements, including a documented letter of authorization and careful boundaries around confrontation, which are all covered explicitly in the Rules of Engagement before any testing begins.
How long does a red team engagement actually take?Red Team Pentesting
We offer 30-, 60-, and 90-day models. Active testing is typically compressed into a month or less, with about a week for reporting. These time frames balance operational realism against the need to act on results in a reasonable timeframe.
Can red teaming satisfy DORA’s Threat-Led Penetration Testing requirement?Red Team Pentesting
Red teaming is the underlying discipline that Threat-Led Penetration Testing (TLPT) is built on, but TLPT has specific regulatory requirements, including named threat intelligence providers, specific reporting formats, a mandatory purple team phase. Some of these requirements go beyond a standard red team engagement.
Is red teaming worth it if we’ve never had a standard pentest?Red Team Pentesting
Usually not. Red teaming gets the most value when foundational controls and monitoring are already in place to be tested. Organizations earlier in their security maturity typically get more immediate value from a standard pentest or security assessment first, as they give more practical advice for building up those foundational controls.
What does a red team engagement actually cost?Red Team Pentesting
This depends on a variety of factors. Pricing is based on estimated effort and daily consulting rate, scaled to organizational size and attack surface, with a premium for required off-hours testing. Reach out for a scoping conversation specific to your environment.
Does a ride along cost more than a traditional penetration test?Ride Along Pentesting
Scoping follows the same effort-based model as our other engagements. A ride along isn’t inherently more expensive, although the collaborative format may impact the timeline and coordination compared to a fully independent test.
Can a ride along be done remotely?Ride Along Pentesting
Yes. Ride along engagements work virtually or in person, whichever fits your team and the environment being tested.
How is a ride along different from purple teaming?Ride Along Pentesting
A ride along is a full penetration test with your team embedded throughout for broader skill transfer, not limited to a specific set of controls. Purple teaming is a targeted exercise validating specific detection and response controls with the offensive red team and defensive blue team working together.
Is a ride along less thorough than an independent test?Ride Along Pentesting
No. It follows the same full methodology as any other Secure Ideas penetration test. What changes is who’s involved and how the findings get communicated, not the rigor of the testing itself.
Who benefits most from a ride along?Ride Along Pentesting
Teams building out an internal security function, teams that want testing and training from the same engagement, and organizations planning to eventually bring testing capability in-house.
Do we need an existing security team to do a ride along?Ride Along Pentesting
Not necessarily a dedicated one. IT staff wearing a security hat can just as easily be the team embedded alongside our testers; the format adapts to whatever internal capability currently exists.
Is a time-boxed test less thorough than a comprehensive test?Time-Boxed Pentesting
Rather than being a reduced pentest, the time-boxed assessment is just scoped differently. A time-boxed test won’t examine every system with equal depth, but testers will apply the same rigor as any other Secure Ideas engagement, with a more prioritized scope.
How is the length of the time box decided?Time-Boxed Pentesting
Through a detailed scoping conversation. We work with you to identify what needs the most scrutiny and build a timeframe that fits your actual security needs and constraints, rather than applying a fixed default.
Can time-boxed testing work alongside continuous testing?Time-Boxed Pentesting
Yes, and it often works especially well that way. A time-boxed engagement adds a different kind of scrutiny on top of an existing continuous testing program without the overhead of a full comprehensive test layered in as well.
Is time-boxed testing only for penetration tests?Time-Boxed Pentesting
No. The same fixed-window, prioritized approach applies to security assessments and consulting engagements as well, wherever a focused, efficient scope makes more sense than an open-ended one.
Does modern tooling change what a time-boxed test can cover?Time-Boxed Pentesting
Yes, meaningfully. Many custom protocols and proprietary implementations used to be impractical to test thoroughly within a fixed window, because building the tooling took days. Today, we can set up those tools more quickly and efficiently, letting a time-boxed engagement reach further than it could a few years ago.
Is a time-boxed test a good first step if we’ve never had a pentest before?Time-Boxed Pentesting
Often, yes. It’s a practical way to get real, actionable results and establish a security baseline without committing to the cost and scope of a full comprehensive engagement right out of the gate. By setting priorities and a narrow scope, testers can focus on the assets you need testing, and the questions you need to answer now, rather than going as deep as possible on systems or applications you may still be building out.
How long does a network pentest take?Network Pentesting
It depends, as timelines scale with scope. A small external test typically runs about three days, while a large internal engagement can run for 13 days or more. Your quote will include a specific timeline based on your host and IP counts.
Will testing disrupt our production network?Network Pentesting
It may, but we try to avoid disruption as much as possible. Our team coordinates testing windows and communicates continuously throughout the engagement to minimize risk to production systems.
Denial-of-Service (DoS) style attacks are excluded by default unless specifically requested, as they tend to be disruptive by nature.
What’s the difference between internal and external testing?Network Pentesting
The difference is where the penetration tester starts testing in relation to your network perimeter.
- External testing simulates an attacker on the open Internet with no prior access.
- Internal testing simulates an attacker who already has some level of access to your internal network, such as a compromised workstation.
Do you provide a device, or install software on our network?Network Pentesting
For internal testing, we typically use a small device or virtual machine we call the Secure Ideas Attack Machine (SIAM). The SIAM is a custom-configured Kali Linux box, loaded with the tools our consultants need for internal network penetration testing. The SIAM is our tester’s workstation, which they can access without needing to be in your office. After connecting it to your network, the SIAM establishes an outbound connection back to our infrastructure over a VPN. From there, consultants can work against your internal environment.
Does a network pentest satisfy PCI DSS or HIPAA requirements?Network Pentesting
Yes. Network pentests are commonly used to meet recurring assessment requirements under the Payment Card Industry Digital Security Standard (PCI DSS), US Healthcare Information Portability and Accountability Act (HIPAA), and similar frameworks.
What’s the difference between a web, mobile, and API pentest?Application Pentesting
The difference is the target of the tests:
- A web pentest targets your application layer through the browser, the same way users would interact with the application on your desktop website.
- A mobile pentest examines the app on-device (iOS or Android usually), as well as its backend, and the communication between them.
- An API pentest tests your endpoints directly, independent of any front end.
Most organizations with a connected product need at least two of the three.
Do you need source code access?Application Pentesting
No. Our standard gray box approach only requires application access and a couple of test accounts per role. Source code review is available for collaborative or white-box engagements if your team wants a deeper, more educational format.
Should we test in staging instead of production?Application Pentesting
For pre-release or SDLC testing, we recommend testing in staging to minimize disruptions. We will coordinate scope and timing around your release cycle and can open findings directly in your bug tracker, such as Jira.
We can perform testing on production applications. We work with you to establish Rules of Engagement (RoE), but testing on a live application may allow our testers to reach live customer data.
How long does an application pentest take?Application Pentesting
Timelines scale with scope. A small API test runs about four days, while a large web or mobile engagement can run 13 days or more. Your quote will include a specific timeline based on your application’s size and role complexity.
Does an application pentest satisfy PCI DSS, HIPAA, or SOC 2 requirements?Application Pentesting
Yes. Application pentests are commonly used to meet recurring assessment requirements under PCI DSS, HIPAA, SOC 2, and similar frameworks.
What if I need testing every sprint, not once a year?Application Pentesting
That’s exactly what PETaaS® Credits are built for. Prepay for a block of capacity and deploy it against releases as they ship, instead of trying to fit continuous development into a single annual engagement.
Will testing risk disrupting our production process?OT Pentesting
We plan testing around production to avoid disruptions. We start testing with passive information gathering to understand your environment before any active testing begins. There is always a risk of disruption, but we take steps to prevent it. Active testing techniques and timing are scoped specifically to minimize risk to production availability, and Denial-of-Service (DoS) style attacks are excluded by default.
Is OT testing different from a standard IT network pentest?OT Pentesting
Yes. OT environments often run legacy equipment that was never designed to handle standard IT testing techniques. Our approach accounts for the unique performance, reliability, and safety requirements of industrial control systems.
Do you test the IT / OT boundary specifically?OT Pentesting
Yes, and we typically recommend it. Most real-world OT incidents originate on the IT side and cross into OT through weak segmentation, shared credentials, or forgotten remote access paths.
How long does an OT pentest take?OT Pentesting
Timelines scale with environment complexity, from about 5 days for a simple, isolated segment to 18 days or more for an enterprise-wide, multi-site ICS/SCADA environment. Your quote will include a specific timeline based on your equipment mix.
What industries do you have OT testing experience with?OT Pentesting
Our team has hands-on experience across electrical utilities, natural gas, gas and oil, vehicle and automotive, food and beverage, and amusement, among other sectors.
Do we need to ship you a physical device?IoT & Embedded Device Pentesting
In most cases, yes. Hardware-level testing requires physical access to the device itself. We’ll work with you during scoping to confirm exactly what’s needed, including test units, debug access, or development boards. Testing can be scoped as destructive or non-destructive, if you need the device back afterward (although testers can get more information by disassembling the device).
Learn More About IoT and Embedded Device Penetration Testing ›
Does testing cover the companion app and cloud API too?IoT & Embedded Device Pentesting
Yes, it can if it needs to. Most connected devices ship with a mobile app and a backend API, and we regularly test that full ecosystem alongside the device itself, since vulnerabilities often show up at the seams between the digital and physical.
Learn More About IoT and Embedded Device Penetration Testing ›
Can you test a device before it launches?IoT & Embedded Device Pentesting
Yes, and it’s often the ideal time. Testing pre-production hardware and firmware lets you fix issues before they’re baked into a manufacturing run or a public release. Remediating issues in the firmware first means fewer worries about users not updating their devices in the wild.
Learn More About IoT and Embedded Device Penetration Testing ›
How long does an embedded device pentest take?IoT & Embedded Device Pentesting
Timelines scale with complexity, from about 5 days for a simple standalone device to 18 days or more for a device with a companion app, cloud API, and multiple firmware variants. Your quote will include a specific timeline once we understand your device.
Learn More About IoT and Embedded Device Penetration Testing ›
What kinds of devices have you tested before?IoT & Embedded Device Pentesting
Our team has experience across many kinds of devices, including door access systems, controller remotes, DVRs and IP cameras, medical devices, sensor nodes, and network appliances, among others.
Learn More About IoT and Embedded Device Penetration Testing ›
Is physical penetration testing legal?Physical Pentesting
Yes, when it’s properly authorized. Every engagement is scoped in advance with your organization’s written approval, and our testers always carry a Letter of Authorization when they’re on-site. Our consultants perform non-destructive bypass techniques unless authorized to do otherwise.
What happens if a guard or employee stops your tester?Physical Pentesting
This is actually a good outcome. In these instances, our tester presents the Letter of Authorization, and pauses testing until the challenge is resolved. We treat a challenge as a data point about how well your team is paying attention, not a problem to avoid.
Will our security staff know the test is happening in advance?Physical Pentesting
That depends on what you want to learn. Some engagements involve only a small control group at the top of the organization, while others use a joint walkthrough where staff know from the start. We’ll help you decide during scoping.
Could testing damage our locks or property?Physical Pentesting
We prioritize non-destructive bypass techniques like shimming over traditional lock picking whenever possible, and we coordinate with you on acceptable methods and any risk of damage before testing begins.
How is physical testing different from a red team engagement?Physical Pentesting
The difference is in the focus of testing:
- Physical testing focuses specifically on facility access and physical controls.
- A red team engagement is broader and longer, combining physical access with network and application attacks toward a specific objective over weeks or months.
What do we get at the end of a physical pentest?Physical Pentesting
A detailed report documenting each of our access attempts, with photographs and narratives. These findings will identify gaps in physical controls and personnel awareness, and all come with prioritized recommendations you can act on.
Does wireless testing have to happen on-site?Wireless Pentesting
It can but doesn’t have to. Secure Ideas can conduct wireless testing remotely using our SIAM devices, which reduces cost and speeds up turnaround compared to sending a consultant on-site. On-site testing is also available when it fits your needs better.
Should wireless testing be scoped with our internal network test?Wireless Pentesting
Often, yes. Wireless testing is frequently performed alongside internal network penetration tests, since a compromised wireless network can act as another path onto the same internal network.
Will testing disrupt our wireless network for employees?Wireless Pentesting
We coordinate testing windows and techniques to minimize disruption. Deauthentication testing is targeted and time-boxed rather than run as a sustained Denial-of-Service (DoS) against your network.
Do you test IoT protocols like Zigbee or Bluetooth?Wireless Pentesting
Yes, as extended protocol testing alongside standard Wi-Fi assessment. Let us know during scoping if your environment includes Bluetooth, Zigbee, Z-Wave, or LoRa devices.
How long does a wireless pentest take?Wireless Pentesting
Timelines scale with scope, from about 3 days for a single-SSID configuration review to 13 days or more for a large, multi-network environment with a full architecture review. Your quote will include a specific timeline based on your environment.
Are there prerequisites for the CISSP Mentorship?CISSP Mentorship
The mentorship program itself has no prerequisites. The CISSP certification from ISC2 does have its own experience requirements, which are set by ISC2, not by Secure Ideas.
Do I need to buy the CISSP Mentorship textbook separately?CISSP Mentorship
The program is built around the official ISC2 CISSP study guide. Depending on your contribution tier, the guide may be included, details on that will be confirmed on the registration page.
What do I need to bring to the CISSP Mentorship?CISSP Mentorship
The program runs through a combination of live video conferencing and recorded materials, so a laptop or desktop with a reliable internet connection is all that’s really required.
What if I don’t pass the CISSP on my first attempt?CISSP Mentorship
You’re welcome to go through the program again in a future session at no additional cost. Most students pass the first time, but the option is always there if you need it.