23 NYCRR 500 Penetration Testing

NYCRR requires annual penetration testing for covered entities.

A high-quality penetration test satisfies regulatory requirements while also improving situational awareness and defense-in-depth.

A vulnerability scan is not a penetration test. Our team provides a full scope penetration test that satisfies the requirements of 23 NYCRR 500 and produces the complete documentation necessary for regulatory compliance and adherence to NYDFS rules. Our team's knowledge and experience provide the context and insight that automated security tools lack.

Look through the eyes of a hacker.

Penetration testers use the tools and techniques of a hacker to provide you a unique view of your organization.

Modern cybersecurity products are highly efficient and provide broad protection against a wide range of threats, but they are far from perfect. While defenders worry about securing a massive number of devices and services, your adversaries have laser-like focus on the handful of most vulnerable devices.

Like a real adverary, our pen testers draw upon a deep understanding of security and follow their instincts to probe the most serious weaknesses in your infrastructure. By emulating adversarial tactics, we demonstrate how minor security issues can be combined to lead to a full-blown compromise.

Meet the team.

We have assessed a wide range of businesses, from tech startup to multinational law firm.

Our senior penetration tester, Alejandro (Alex) Caceres, has years of experience conducting pen tests for government agencies and the private sector alike. Alex is an active security researcher and trainer:

• Speaker at major conferences like DEFCON and Shmoocon.
• Featured in Forbes magazine.
• Creator of open source security tools.
• Author of security articles on the Gray Area blog
• Creator and instructor of online security training.

Our team possesses the most desired certifications in the industry, including the CEH, CISSP, and OSCP. We are based in the U.S. and Canada, with availablity for remote work and travel.

Most penetration test teams focus 100% on offensive security and have little experience on defense. As a result, they often give you expensive and impractical advice!

Our team is unique. We are not just ethical hackers. We also write code and manage our own infrastructure every day. So we understand the difficulty of balancing business needs with security concerns. You can rest assured that we will never recommend security measures that we would not adopt ourselves.