"Isn't a penetration test a one-time thing?" We hear that from almost every small business the first time it shows up on a quote, a customer security questionnaire or a cyber insurance application. The short answer is no, and the reason is simple: a test is only valid for the configuration that existed on the day it ran. This article explains what a penetration test is, what it isn't, who requires one, what it costs in the Maryland, DC and Virginia market, and how to buy it without overpaying.
What a penetration test actually is
A penetration test (pen test) is an authorized, simulated attack on your systems to find out what a real attacker could do. A tester, human or automated, probes your network, devices and applications the way a criminal would: scanning for exposed services, trying known exploits, chaining small weaknesses into a path to your data, and then documenting exactly how far they got and how to close the gap.
The deliverable is a report that lists each finding, rates its severity, shows proof, and gives remediation steps. A good engagement includes a retest after you fix things, so the final report shows the issues closed.
Pen test vs. vulnerability scan: not the same thing
This is where most small businesses get sold the wrong product.
- A vulnerability scan is automated and inventory-driven. It compares your systems against a database of known weaknesses and produces a list, often a long one, with no proof that any item is actually exploitable in your environment. Scans are cheap, fast and should run continuously. They are not a pen test.
- A penetration test validates and exploits. It tells you which of those weaknesses matter, what an attacker reaches by using them, and how your defenses respond. It takes judgment, which is why human-led tests cost more.
- Automated network penetration testing is a newer middle tier: software that doesn't just scan but actually attempts exploitation, lateral movement and credential attacks inside your network on a schedule, with a report after each run. For organizations under about 100 people, it has become the practical way to get recurring testing at a subscription price.
If a quote under roughly $4,000 is described as a "penetration test," ask whether a human will attempt exploitation. Usually the honest answer is that it's a scan with a nicer report.
The kinds of test, and which ones a small business needs
- External network test. Everything reachable from the internet: your firewall, VPN, remote desktop, web servers, mail and cloud sign-in pages. This is the baseline every organization should run.
- Internal network test. What an attacker can do once inside, whether through a phished laptop or a rogue device in the conference room. For most small businesses this is where the alarming findings live: shared local admin passwords, legacy protocols, flat networks, printers with default credentials.
- Web application test. For organizations that run a client portal, a custom app or an online store. Priced separately and scoped per application.
- Cloud and identity test. Microsoft 365 or Google Workspace configuration, conditional access gaps, over-privileged accounts, token abuse. Increasingly the most valuable test for companies with no on-premises servers.
- Social engineering. Phishing, phone pretexting and physical entry attempts. Often bundled with a security awareness program rather than a technical test.
A typical first engagement for a 20- to 75-person company is an external plus internal network test, with a cloud identity review if you live in Microsoft 365.
Why it has to recur
Your environment changes every week. A new laptop joins the domain, a vendor opens a firewall rule for remote support, someone installs a browser extension, Microsoft ships a patch that changes a default, a contractor's account is created and forgotten. Each change can open a path that didn't exist when the last test ran. The test you did in March says nothing about the firewall rule added in June.
That is why frameworks and customers ask for testing on a cadence, not a certificate. Annual human-led testing with continuous automated testing in between is the pattern most auditors accept, and it's what we deliver inside our managed IT and security agreements.
Who requires penetration testing
- SOC 2 expects you to identify and evaluate vulnerabilities (CC4.1, CC7.1); auditors routinely ask for a recent pen test report as evidence.
- ISO 27001:2022 control A.8.8 (management of technical vulnerabilities).
- PCI DSS 4.0 requirement 11.4 mandates internal and external penetration testing at least annually and after significant changes.
- CMMC and NIST SP 800-171 for defense contractors include vulnerability scanning and remediation requirements that testing supports.
- HIPAA requires a risk analysis; pen testing is the accepted way to show technical evaluation was done.
- Cyber insurance applications increasingly ask the date of your last test.
- Enterprise and utility customers in this region often reserve the right to test their suppliers and bill remediation back to you. Testing yourself first is cheaper than having a customer find it.
What it costs in the DMV
- Human-led external + internal network test for a small business: $8,000 to $20,000 per engagement depending on IP count, locations and whether a retest is included. Washington-area rates sit toward the upper half of that range.
- Web application test: $5,000 to $15,000 per application, more for complex ones.
- Automated recurring network testing delivered through a managed services agreement: typically a few hundred dollars a month, which puts year-round testing below the price of a single manual test.
- Under $4,000: almost certainly a vulnerability scan. Useful, but call it what it is.
For context, one of our clients pays $600 a month for continuous testing inside their managed services fee. That's $7,200 a year, less than the market price of one manual test, for testing that runs against the environment as it is today rather than as it was last spring.
How to buy a pen test without getting burned
- Ask for the methodology. Reputable testers reference a standard (PTES, OWASP, NIST SP 800-115) and can explain their rules of engagement.
- Define scope in writing. IP ranges, applications, cloud tenants, what's excluded, and the testing window. Scope creep is how a $10,000 quote becomes $18,000.
- Insist on a retest. A findings report without a verified-fixed report leaves you with a document that proves you had problems.
- Ask who remediates. Most pen test firms test and leave. If you don't have an IT team ready to fix findings within 30 to 60 days, the report sits in a drawer and the compliance value evaporates. This is the practical reason many small businesses buy testing through their MSP: the same team that finds it fixes it.
- Get a sample report. It should be readable by a non-technical executive in the first two pages and precise enough for a technician after that.
- Confirm the tester is independent of the thing being tested when an auditor requires it. For SOC 2 and ISO, your MSP can usually run the recurring automated testing, and some auditors will want a third party for the annual human-led test. Ask your auditor before you buy.
How to prepare
- Update your asset inventory first. You can't scope what you can't list.
- Tell your security monitoring team the dates, or you'll spend the week responding to your own test.
- Make sure backups are current. Testing is designed to be safe, but production systems are production systems.
- Decide in advance who receives the report and who owns remediation.
Frequently asked questions
How often should a small business do a penetration test?
At least annually, and after any significant change such as a new office, a cloud migration, a merger or a major application launch. Continuous automated testing between annual manual tests is the pattern most frameworks and auditors now expect.
Will a penetration test take down our systems?
Professional testing is designed to be non-destructive, and the rules of engagement should exclude denial-of-service techniques unless you specifically ask for them. Fragile legacy systems can be scheduled for after-hours testing or excluded. Mention them during scoping.
Is a penetration test the same as a security assessment or risk assessment?
No. A risk assessment is a broad review of policies, processes and controls against a framework. A penetration test is a technical attack simulation. Most compliance programs require both, and a good provider will tell you which one a given requirement is actually asking for.
Do you offer penetration testing in Maryland, DC and Virginia?
Yes. CIRRUS provides recurring automated network penetration testing as part of its managed security services, coordinates annual third-party testing when an auditor requires independence, and remediates findings for clients across the DMV. Contact us to scope a test or to review a quote you've already received.
