Penetration testing

Find out how far an attacker can get.

I test the way an attacker works: one weakness leads to the next, across your network and cloud and inside your instances and containers, until it reaches your critical data or runs out.

Three ways to test

Black box, gray box, or crystal box.

The difference is how much you show me before I start. The more I see, the less of the test goes to discovery and the more goes to depth.

Black box

What an outsider can reach, starting from nothing.

Starts at$5,000

You share

Nothing but the scope.

What gets tested

  • Your perimeter, whatever it is made of: VPNs, bastion hosts, proxies, gateways, and anything else that faces the internet
  • SSH, SFTP, and FTP: the versions and settings they expose, and whether they let an outsider in
  • DNS records that point at something you no longer control
  • SPF, DKIM, and DMARC, including subdomains whose policy is weaker than the main domain's

Gray box

How far an attacker gets from an ordinary account.

Starts at$8,000

You share

Accounts to test with.

What gets tested

  • The hosts and services behind your perimeter
  • What an ordinary account can become on each host
  • Where one foothold leads next

Crystal box

Every attack path in your AWS accounts, mapped first, then tested.

Starts at$15,000

You share

A role with AWS's SecurityAudit policy.

What gets tested

  • Every route from the internet to your critical data, through security groups, instances, containers, and roles
  • The vulnerabilities inside each instance and container image, chained together
  • Each path tested by hand, from the first hop to the data
  • The fixes that break the most paths, first

The chain

One weakness rarely matters. A chain does.

Scanners rate each finding on its own. An attacker strings them together. Every test follows the chain from one weakness to the next, through your infrastructure and inside your instances and containers, until it reaches something that matters. An example, start to finish:

  1. 01

    The internet

    A security group lets anyone on the internet reach a web server.

  2. 02

    The application

    A medium-severity flaw in the application lets an outsider run a command on the instance.

  3. 03

    The instance

    An outdated package on the same instance turns that command into full control of it.

  4. 04

    The role

    Full control of the instance includes the credentials of the role attached to it.

  5. 05

    The data

    That role can read the bucket that holds your customer data.

Two medium findings and one security group setting, each easy to put off on its own, add up to a breach of your customer data.

Containers get the same treatment: what is inside each image, and what the container can reach from the host it runs on.

Findings

Every finding, with its security and compliance impact.

Each finding comes with its evidence and severity, what it means for your security, how to fix it, and the controls it is supporting evidence for in SOC 2, HIPAA, HITRUST, ISO 27001, PCI DSS, and NIST. Engineering gets the fix. Your compliance lead gets the control it touches, before an auditor or a customer’s security review does.

Sample finding · Severity: High

Internet-facing SSH bastion host

Observation
The SSH service on a bastion host answered a connection from an outside address. It is reachable from the entire internet, not just from the office or the VPN.
Security impact
Malicious actors from the entire internet can attempt to brute force their way into this server as a way of gaining initial entry into the environment behind it. Even if password authentication is disabled, the host is still susceptible to remote code execution vulnerabilities in the SSH service that can be exploited before a key or certificate is ever checked.
Fix
Measure who and what is legitimately interacting with the host. Restrict access to known IP ranges. If unrestricted public access has to remain, conduct a risk analysis to identify mitigating controls and record an exception in the company's risk register.
Compliance impact

Supporting evidence for:

  • HIPAA §164.312(a)(1)
  • HITRUST Domain 08
  • NIST 800-53 AC-17

References are to the HIPAA Security Rule at 45 CFR Part 164, the HITRUST CSF assessment domains, and NIST SP 800-53 Rev. 5.

How a test runs

From scoping to retest.

  1. 01

    Scoping

    We pick black, gray, or crystal box, and agree on what is in scope, the testing window, and the rules of engagement.

  2. 02

    Access

    Black box needs none. For gray box, you share accounts to test with. For crystal box, you deploy a CloudFormation template that creates a cross-account role with AWS's SecurityAudit managed policy, and I map the attack paths before testing starts.

  3. 03

    Testing

    I test what is exposed and follow each weakness to the next, to show where it leads.

  4. 04

    Report

    An executive summary, and the full report: each finding with its evidence, its severity, its security and compliance implications, and how to fix it.

  5. 05

    Retest

    Once you have fixed the findings, I test them again. Then you get an attestation letter to share with customers and auditors: what was tested, when, and the result of the retest, without the findings themselves.

Timeline
Two weeks
You get
  • An attestation letter you can share
  • An executive summary
  • The full report
  • One retest
Source address
Testing comes from the manual-testing address listed on the Scanning page.

The business case

Enterprise customers, vendor security reviews, and cyber insurance applications often ask for a recent third-party penetration test. The attestation letter is written to be shared with them.

The compliance case

Supporting evidence for:

  • SOC 2 CC4.1, CC7.1
  • HIPAA §164.308(a)(8)
  • ISO 27001 A.8.8
  • PCI DSS 11.4.3, 11.4.4
  • NIST CSF ID.RA-01, ID.IM-02
  • NIST 800-53 CA-8

References are to the 2017 Trust Services Criteria for SOC 2, the HIPAA Security Rule at 45 CFR Part 164, ISO/IEC 27001:2022 Annex A, PCI DSS v4.0.1, NIST CSF 2.0, and NIST SP 800-53 Rev. 5.

Pricing

A fixed fee, quoted after a scoping call.

Black box tests start at $5,000, gray box tests at $8,000, and crystal box tests at $15,000.

What moves the price:

  • Black, gray, or crystal box
  • How many internet-facing addresses and hostnames are in scope
  • For crystal box, how many AWS accounts are in scope and how large the environment is

The fee covers the scoping call, the test, the executive summary, the full report, one retest, and the attestation letter.

Start with a conversation.

The right engagement depends on what you’re building and where the gaps are. A 30-minute call gets us to whether and how I can help.

Book a callhello@22security.com