Free Penetration Testing Services

Scope and depth. The free engagement is a focused 40-60 engineer-hour assessment with a fixed scope: one AWS or Azure cloud configuration review, one external perimeter scan, OWASP Top 10 on one public web application (up to 20 pages), an exposed-secrets check, and a CIS Benchmark gap analysis — delivered in 10 business days with a single PDF report mapped to SOC 2, HIPAA, and PCI. Our paid penetration testing service at /penetration-vulnerability-testing-service/ covers larger or more sensitive scopes: multi-application web/API testing, internal network and Active Directory pentests, segmented PCI cardholder-data environments, red-team engagements, mobile binary analysis, retesting after remediation, and engagements requiring NDA-bound onsite work. If you need anything beyond the included list, or you want a recurring annual pentest programme, the paid service is the right path. Many customers run the free pentest first to get familiar with us, then commission the paid engagement for broader scope or a follow-up retest.

Genuinely free. The pentest is our way of demonstrating capability to qualified prospects. We invest 40-60 engineer-hours per engagement on the expectation that some customers will engage us for paid remediation or ongoing managed services. Roughly 35% of free pentest recipients convert to a paid engagement (remediation, managed cloud security, or our paid penetration testing service) within 12 months; the rest simply get the report and move on. No hidden fees, no invoice for the free pentest itself.

Because a 40-60 hour engagement run by senior engineers has real cost. We filter for companies that would benefit and that we could plausibly serve — typically 50+ employees running production cloud workloads with an active compliance or security concern. Approving and running one bad-fit engagement means we could not run another company's free pentest that quarter.

Yes, always. After the scoping call we sign a mutual NDA and a Letter of Authorisation (LoA) that documents scope, timing, targets, and permitted techniques. Your legal team receives the LoA before any testing begins. We do not test anything not explicitly listed. This matters because unauthorised testing is illegal under the US Computer Fraud and Abuse Act (CFAA) — we do not cut corners here.

About 10 business days end-to-end. Days 1-3: application review and scoping call. Days 4-7: active testing. Days 8-10: report writing and debrief call. We can compress this for time-sensitive audit deadlines; tell us during the scoping call.

Generally yes. Our reports are mapped to the specific control requirements each framework expects (e.g., SOC 2 CC6.1/CC6.6/CC7.2, PCI 11.4.1-3). We have had reports accepted by Big 4 and mid-size audit firms on behalf of SOC 2 and PCI customers. Your auditor may still request additional evidence or specific scoping — we will adjust if so.

We notify you within 4 business hours if we find anything we consider actively exploitable or a breach in progress. The written report is delivered at the end of the engagement, but critical findings get same-day disclosure. Remediation is offered on a paid basis; you are under no obligation to engage us for it.

Rarely. We occasionally make exceptions for high-growth Series B companies with an imminent SOC 2 audit, but the baseline expectation is 50+ employees. If you are earlier-stage, we recommend an automated scan first (we can point you at free tools) and engaging us later when the production surface area justifies a human pentest.

You do. The report is your property; we retain an anonymised copy in our internal case library for process improvement. We do not publish or share findings. The NDA covers both directions.