Home › Cyber Security Services › Penetration Testing
Cyber Security
Penetration Testing Services That Pass Enterprise Vendor Security Reviews
Maven's penetration testing services are manual, human-led tests of your web applications, networks and people, delivered by a Chicago-area team that also builds and maintains the systems under test. You get a severity-ranked report, a retest and a letter of attestation your prospects, auditors and insurers will accept.
PTESNIST SP 800-115OWASP WSTGMITRE ATT&CKCVSS 3.1
What Is Penetration Testing?
A penetration test is an authorized, simulated attack in which a skilled tester tries to find and exploit weaknesses in your applications, networks or people the way a real adversary would. Unlike an automated vulnerability scan, it chains findings together to show actual business impact and ends with a prioritized remediation report.
Who needs it
Companies answering an enterprise vendor security questionnaire or SOC 2 auditor
Merchants and service providers in PCI DSS scope (Requirement 11.4)
Any business whose website, portal or app handles customer data
Why now
Why Growing Companies Need a Penetration Test Now
The trigger is rarely a breach. It's a customer. The moment a deal reaches a large company's procurement team, "when was your last penetration test?" is on the form, and the answer decides whether you're an approved vendor.
Enterprise Vendor Security Questionnaires
Third-party risk teams ask for a recent pen test, a summary of findings and proof that critical issues were fixed. A one-page letter of attestation answers all three without handing over your full report.
Compliance Drivers
SOC 2 doesn't name a pen test, but auditors and customers expect one inside the Type II period. PCI DSS v4.0.1 Requirement 11.4 mandates internal and external testing annually and after significant change. HIPAA, ISO 27001, CMMC and most cyber insurers ask too. See compliance readiness.
Penetration Test vs. Vulnerability Scan
A scan is automated and lists known weaknesses. A penetration test is a person exploiting and chaining them to prove impact. A scan alone does not satisfy PCI 11.4 or most customer reviews; we run both and tell you which one you actually need.
What's included
Our Penetration Testing Services
Scope one test type or combine them. Each engagement is fixed-fee, includes a remediation retest and maps to the compliance requirement that drove it.
01
External Penetration Testing
We attack your internet-facing perimeter from the outside with no prior access: public IPs, VPNs, mail, DNS, exposed services and cloud entry points. The test shows what an opportunistic attacker could reach from anywhere.
Maps to PCI DSS 11.4.2 and the "external test" line on most questionnaires.
02
Internal Penetration Testing
An assumed-breach test: we start with the access a phished employee or rogue device would have and see how far it goes. Active Directory attack paths, lateral movement, privilege escalation and access to sensitive data.
Maps to PCI DSS 11.4.3. Delivered on-site in Chicagoland or remotely by VPN or appliance.
03
Web Application Penetration Testing
Authenticated and unauthenticated testing of your web apps, customer portals, WordPress and WooCommerce sites and APIs against the OWASP Top 10 and the OWASP Web Security Testing Guide, including business-logic flaws scanners miss.
Tested by people who build and maintain production WordPress, PHP and JavaScript sites.
04
Social Engineering Penetration Testing
Phishing, vishing (voice), smishing (SMS) and help-desk pretexting campaigns built on your real org chart, with optional USB drops and tailgating at Chicago-area sites. You get click, credential and report rates by department plus targeted training recommendations.
Evidence for the security-awareness controls in SOC 2, HIPAA, ISO 27001 and cyber insurance applications.
05
OSINT Assessment & Dark Web Monitoring
We map your public footprint the way an attacker's reconnaissance does, then search breach corpora, paste sites and criminal marketplaces for employee credentials and company data being sold. Delivered as an exposure report, with optional continuous alerting when new breached credentials appear.
The cheapest test to run first, and the one most companies have never done.
06
Network Segmentation Testing (PCI DSS)
Bidirectional connectivity tests that prove your cardholder data environment is isolated from the rest of the network, with audit-ready evidence for your QSA or SAQ. Required at least annually and after segmentation changes; every six months for service providers.
Maps to PCI DSS v4.0.1 Requirements 11.4.5 and 11.4.6.
Methodology
Our Penetration Testing Process, in a Clear Order
Aligned with the Penetration Testing Execution Standard (PTES) and NIST SP 800-115. Web testing follows the OWASP WSTG; findings are mapped to MITRE ATT&CK and scored with CVSS 3.1 so your team can prioritize without a translator.
Typical timeline: scoping 1–3 days · testing 1–2 weeks for a focused scope, 3–4 weeks combined · report within 5 business days · retest window 30–60 days.
01
Scoping and Rules of Engagement
Assets, test types, black/grey/white-box access, windows, exclusions, emergency-stop contact and written authorization.
02
Reconnaissance and OSINT
Footprinting, subdomain and service discovery, breached-credential checks and the attack surface a real adversary would start from.
03
Enumeration and Vulnerability Analysis
Automated scanning to cover ground, then manual verification to remove false positives and find what tools can't.
04
Exploitation and Attack-Path Chaining
Safe, controlled exploitation that links findings into realistic attack paths. Critical issues are reported the same day, not at the end.
05
Post-Exploitation and Impact
What data, systems and accounts an attacker could reach, documented with evidence and reproduction steps.
06
Reporting and Executive Debrief
A plain-English executive summary for leadership and buyers, a technical report for your team, and a live walkthrough.
07
Remediation Support and Retest
We help fix, or fix it ourselves on sites we manage, then retest and issue the updated report and letter of attestation.
What you receive
Deliverables Built to Be Handed to a Buyer
Executive Summary
Two to five pages leadership and procurement teams can read without a glossary.
Technical Report
Severity-ranked findings with evidence, reproduction steps, CVSS scores, ATT&CK mapping and prioritized fixes.
Remediation Retest
Included within the retest window, with an updated report showing what was fixed.
Letter of Attestation
One page confirming who tested what, when, how and the outcome, built to share with prospects, auditors and insurers. Pairs with our attestation and audit support.
Continuous Exposure Monitoring (Optional)
Dark web and breached-credential alerts between annual tests.
Questionnaire Answers
We draft the pen-test section of your next vendor security questionnaire from the results.
What we measure
Critical and high findings closed within the retest window
Attack paths eliminated, not just individual vulnerabilities patched
Security reviews cleared using the report and attestation letter
Compliance evidence accepted by your SOC 2 auditor or QSA
Exposed credentials found and reset, year over year
Black Box, Grey Box or White Box?
Black box simulates an outsider with no knowledge; white box gives us architecture and source for depth. We recommend grey box, with credentials and documentation, for the best coverage per dollar.
Why Maven
A Pen Testing Company That Also Fixes What It Finds
01
Builders Testing Builders' Work
Our testers build and maintain production WordPress, PHP and JavaScript sites every day, so web application findings come with fixes that work in your stack. On sites we manage under website maintenance, we apply them ourselves.
02
Reports Written for the Deal
Plain-English executive summaries, a shareable letter of attestation and a retest included, so the test clears the security review instead of starting a new round of questions. Need the full audit? See compliance readiness.
03
Fixed Scope, Chicago-Area, Nationwide
Fixed-fee quotes after a scoping call. External, internal, web app and OSINT testing delivered remotely anywhere in the US; on-site social engineering and internal testing across Chicagoland from our Lake Zurich and Deerfield offices.
Proof
GXC Inc.: Security Equipment, Enterprise Buyers
When a security-equipment manufacturer's growth program started attracting enterprise and government buyers, every new account came with a vendor security review. Maven's work with GXC Inc. produced an 880% return over twelve months and 200+ leads a month at a 42% conversion rate; the same team now scopes the testing those buyers ask for.
Penetration testing pricing
How a Penetration Test Is Scoped
Price depends on the number of external IPs and internal hosts, application size and complexity, the test types combined, and whether social engineering is included. Every engagement is quoted as a fixed fee with the retest built in. A focused external or web application test typically starts in the low five figures; a scoping call gives you an exact number within two business days.
FAQ
Penetration Testing Questions
Does SOC 2 require a penetration test?
Not explicitly. The Trust Services Criteria don't name one, but auditors and enterprise customers expect a penetration test under the Security criteria, and most Type II reports include one performed inside the observation period. Annual testing is the accepted baseline.
What does PCI DSS require for penetration testing?
PCI DSS v4.0.1 Requirement 11.4 calls for internal and external penetration testing at least every twelve months and after significant changes, fixing and retesting exploitable findings, and segmentation testing annually, or every six months for service providers. The tester must be qualified and organizationally independent.
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan is automated and produces a list of known weaknesses. A penetration test is a human exploiting and chaining those weaknesses to prove real impact. A scan alone doesn't satisfy PCI Requirement 11.4 or most customer security reviews.
How much does a penetration test cost?
It depends on asset count, application complexity and the test types combined. A focused external or web application test typically starts in the low five figures; combined scopes cost more. Maven quotes a fixed fee, retest included, after a short scoping call.
How long does a penetration test take?
One to two weeks of active testing for a focused scope, three to four for combined external, internal and web application scopes, plus about a week for reporting and a 30-to-60-day retest window.
Will testing disrupt our systems?
We agree on testing windows, exclusions and an emergency-stop contact before starting, never use denial-of-service techniques, and report critical findings immediately. Staging environments are used wherever they exist.
What is a letter of attestation, and can we share it?
A one-page confirmation of who tested what, when, how and the outcome. It's written to be shared with prospects, auditors and insurers instead of the full report, which stays internal or goes out under NDA.
What is the difference between external and internal penetration testing?
External testing attacks your internet-facing perimeter from outside with no access. Internal testing assumes an attacker is already on the network, through phishing or a compromised device, and measures how far they can get. PCI DSS requires both.
Related cyber security services
Compliance Readiness
SOC 2, HIPAA, ISO 27001, PCI DSS and NIST CSF gap assessments that turn test findings into an audit-ready program.
Attestation & Audit Support
SOC 1 and SOC 2 reports via an independent CPA firm, PCI ROC and AOC via a PCI SSC-listed QSA, coordinated by Maven.
Website Maintenance Plans
Security updates, monitoring and backups that keep findings fixed between annual tests.
Get a Scoped Penetration Testing Quote
Tell us what's in scope and who's asking for the test. You'll have a fixed-fee proposal, with the retest and attestation letter included, within two business days.
