Guide
Penetration testing for small business, without wasted spend
Penetration testing for small business usually starts because a customer or insurer asked for it. So the goal is the right test for the request, not the biggest one you can buy.
- Fixed fee before we start
- Named tester in writing
- Retest and attestation letter
Why small businesses get asked for a test
Larger customers now send security questionnaires to every supplier. Also, cyber insurers increasingly ask whether you have been tested. Therefore even a ten-person company can need a report.
Where penetration testing for small business should start
Start with the thing customers touch. Usually that is one web application or your external network, so the Essential package often fits.
- One customer-facing app, or
- Your internet edge: email, remote access and website
Penetration testing for small business: quick check
Tick what applies. It tells us which package to propose.
Your result appears here as you tick, so you can see what is still open.
What it costs at small scale
The Essential pentest starts at $5,900 for one asset, with at least 15 manual hours. That is a real test, because anything under about $4,000 is almost certainly an automated scan.
| Need | Usual fit | From |
|---|---|---|
| One app or one network | Essential. | $5,900. |
| App, API and network | Standard. | $14,500. |
Avoiding a scan sold as a test
Ask for the manual hours in writing. Also ask who will test. If a quote is very low and cannot answer either, it is probably a scan, so it may not satisfy the customer who asked.
When penetration testing for small business should grow
Grow the scope when your product grows. For example, adding an API, a mobile app or multiple user roles means a broader test next year. Until then, one well-tested asset is better than three tested thinly.
Questions about penetration testing for small business
Is penetration testing for small business worth it?
If a customer or insurer asks for it, yes, because the report often unlocks the deal.
What is the smallest real test?
One asset with at least 15 manual hours, which is our Essential package from $5,900.
How fast can it start?
Usually within one to two weeks, and the report follows about ten working days after testing.
Do we need an IT team?
No, but someone must be able to fix findings, so name a contact or supplier.
Related guides
Start penetration testing for small business at one asset
Tell us what was requested and by whom. We reply with a fixed fee, so you can answer the questionnaire with confidence.
Get my fixed-fee quote