Tell us what you need tested. We confirm targets, test windows, and written authorization before anything runs.
Reports support PCI DSS 11.4, HIPAA, SOC 2, CMMC Level 2, and cyber insurance applications.
On-Site Technology runs automated internal and external network penetration tests that exploit weaknesses the way an attacker would. Tests run monthly, quarterly, semi-annually, or annually; one-time tests can be retested within 30 days. Each engagement includes a report walkthrough and remediation recommendations, and reports support PCI DSS, HIPAA, SOC 2, and cyber insurance. Penetration testing is delivered remotely to businesses across the United States, with deepest engineering capacity in Northern NJ, the NYC metro, Pennsylvania, and South Florida.
Network penetration testing is an authorized, simulated attack on your internal and external networks that shows what a real attacker could reach. Every test follows the route an intruder takes: get in, steal credentials, climb to administrator, and head for your data. It uses techniques documented in the MITRE ATT&CK framework, and because it is automated, it runs the same way every time, so this quarter’s results compare cleanly with the last.
Public records, DNS, and exposed services show what an attacker can see from outside.
Host discovery and service enumeration map every system the test can reach.
Password, man-in-the-middle, and relay attacks show whether a weakness actually opens a door.
From a foothold, the test tries to become a local or domain administrator.
It moves from system to system, the way ransomware operators do.
It looks for the files and databases an attacker would steal or encrypt.
Every action is time-stamped in the activity log, so you can also check what your own monitoring caught.
Most compliance programs expect both, because they answer different questions.
Attacks your internet-facing perimeter the way an outside adversary would.
Assumes an attacker is already inside, for example after a successful phish.
Confirms that a PCI DSS cardholder data environment, or any sensitive network, is actually isolated from the rest.
Retest on a schedule instead of relying on a once-a-year snapshot, so new exposures surface as your network changes.
On-Site Technology is headquartered in Clifton, NJ and tests networks for businesses across Northern and Southern New Jersey. External tests run remotely. Internal tests use a small device or virtual machine connected to your network, so the test itself needs no one on-site.
These are the requirements that most often put penetration testing on a New Jersey company’s calendar. The same service is available to businesses anywhere in the U.S.
HIPAA Security Rule technical evaluation, and the questions your cyber insurer asks at renewal.
PCI DSS Requirement 11.4 internal, external, and segmentation testing.
NYDFS 23 NYCRR 500.5 requires annual penetration testing from inside and outside the network for firms licensed in New York, which includes many New Jersey firms.
Testing evidence for CMMC Level 2 readiness when you handle CUI.
Proof of testing for client security questionnaires and cyber insurance applications.
Illustrative example of the report format, not a client result.
A report package built for executives, engineers, auditors, and cyber insurance underwriters, plus a person to walk you through it.
A plain-language risk summary for leadership: what matters most to the business and what to do about it.
Affected systems, supporting evidence, the risk created, and step-by-step remediation guidance for each finding.
Every action the test performed, time-stamped, so you can compare it with what your alerting caught.
An On-Site Technology engineer reviews the results with your team and answers questions.
Prioritized, so the first fixes close the most risk.
Available as a separate engagement, quoted on its own and not included in the test.
A scan lists what might be wrong. A penetration test shows what an attacker could actually reach. A consultant-led test goes deeper on web applications and business logic, at a higher cost.
| Attribute | Vulnerability scan | Automated pen testWhat On-Site Technology delivers | Consultant-led pen test |
|---|---|---|---|
| What it does | Lists potential weaknesses | Exploits weaknesses the way an attacker would | Testers exploit weaknesses by hand |
| Proves real impact | No | Yes, including privilege escalation and lateral movement | Yes |
| Web apps and business logic | Not covered | Not covered; network testing only | Covered when scoped |
| Testing cadence | Continuous or weekly | Monthly, quarterly, semi-annual, or annual | Usually annual, because of cost |
| Consistency | Same checks every run | Same methodology every run | Varies with the tester |
| Relative cost | Lowest | Moderate | Highest |
| Remediation help | None | Walkthrough and prioritized recommendations; fixes available from our engineers | Report delivered; fixes are typically on you |
Need web application or API testing? That calls for a consultant-led engagement, and we flag it during scoping.
At least once a year, and again after major changes such as a new system, a network redesign, or a merger. PCI DSS v4.0 requires internal and external testing at least every 12 months. Pick the rhythm that matches how fast your network changes.
Just need one test? A one-time test can be retested within 30 days to confirm the fixes worked.
Reports give auditors, assessors, and underwriters the evidence they ask for. Your auditor or assessor decides what satisfies a specific requirement.
| Framework | Requirement | How the report helps |
|---|---|---|
| PCI DSS v4.0 | Requirement 11.4 | Internal and external penetration testing, including segmentation testing of the cardholder data environment. See PCI DSS compliance. |
| HIPAA Security Rule | §164.308(a)(8) | Technical evaluation evidence, and input to your §164.308(a)(1)(ii)(A) risk analysis. |
| CMMC 2.0 Level 2 | CA.L2-3.12.1 | Independent network testing evidence for security assessment practices. See CMMC readiness. |
| NYDFS 23 NYCRR 500 | Section 500.5(a)(1) | Annual penetration testing from both inside and outside your network boundary, for firms licensed by the New York Department of Financial Services. |
| NIST SP 800-53 | CA-8 | Supports the penetration testing control, with findings your team can carry into NIST CSF 2.0 reporting. |
| SOC 2 and ISO 27001 | CC7.1 and Annex A 8.8 | Evidence for vulnerability detection and technical vulnerability management under ISO/IEC 27001:2022. |
| Cyber insurance | Applications and renewals | Reports you can hand your broker when an application asks whether you test your network and fix what you find. See cyber insurance readiness. |
A testing vendor hands you a report. A managed IT and security partner tests your network, explains the results, and can fix what it finds.
Every engagement includes a report walkthrough with an engineer, so findings reach the people who fund the fixes.
Our team can carry out remediation as a separate engagement, then retest to confirm it worked.
Testing sits alongside our managed cybersecurity, 24/7 SOC monitoring, and CMMC readiness work.
Family-owned, headquartered in Clifton, NJ with an office in Ft. Lauderdale, FL, and testing delivered remotely across the U.S.
The questions businesses ask before every engagement.
Network penetration testing is an authorized, simulated attack on your internal and external networks. It exploits weaknesses the way a real attacker would, then escalates privileges and moves laterally to show what someone could actually reach, so you can fix the paths that matter most.
A vulnerability scan lists potential weaknesses and stops there. A penetration test tries to exploit them, then escalates privileges and moves laterally to show what an attacker could actually reach. Most compliance frameworks, including PCI DSS, expect penetration testing rather than scanning alone.
At least annually, and again after any significant change such as a new system, a network redesign, or a merger. PCI DSS v4.0 requires internal and external testing at least once every 12 months. We offer monthly, quarterly, semi-annual, and annual testing programs.
Yes. External testing attacks your perimeter from the public internet. Internal testing simulates an attacker who already has a foothold, such as after a successful phish, using a small device connected to your network. Most compliance programs expect both, because they answer different risk questions.
For network testing, automated testing runs the same attack phases every time, which makes results comparable from one test to the next and makes monthly or quarterly testing affordable. A consultant-led manual test goes deeper on web applications and business logic, at a higher cost. Many businesses run automated network testing on a regular cadence and bring in a consultant when an application needs it.
No. Our penetration testing covers internal and external networks. Web application, API, and cloud configuration testing are separate disciplines that call for a consultant-led engagement.
Every engagement includes prioritized remediation recommendations and a report walkthrough. Our engineers can also carry out the fixes as a separate engagement, which is quoted on its own and not included in the test. One-time tests can be retested within 30 days, and recurring programs retest on the schedule you choose.
Yes, as evidence. Reports support PCI DSS v4.0 Requirement 11.4 including segmentation testing, NYDFS 23 NYCRR 500.5, HIPAA §164.308(a)(8), NIST SP 800-53 CA-8, CMMC Level 2 practice CA.L2-3.12.1, SOC 2 CC7.1, ISO/IEC 27001:2022 Annex A 8.8, and cyber insurance applications. Your auditor or assessor decides what satisfies a specific requirement.
Yes. On-Site Technology is headquartered in Clifton, NJ and tests networks for businesses across Northern and Southern New Jersey. External tests run remotely, and internal tests use a small device or virtual machine connected to your network, so the test itself needs no one on-site.
Yes. Penetration testing is delivered remotely to businesses across the United States, with deepest engineering capacity in Northern NJ, the NYC metro, Pennsylvania, and South Florida. External tests run from the public internet, and internal tests use a small device connected to your network. On-Site Technology is headquartered in Clifton, NJ with a second office in Ft. Lauderdale, FL.
Ask four things: what is in scope (internal network, external network, web applications, cloud), whether testing is automated or manual, how retesting works after you fix findings, and who helps with remediation. Also confirm the provider gets written authorization and agrees test windows before anything runs. Our guide to choosing a penetration testing provider goes deeper.
Pricing depends on the size of your network, whether you need internal testing, external testing, or both, and how often you want to test. For a broader look at what drives price, see our Complete Guide to Penetration Testing Cost, or request a no-obligation scoping consultation.
Testing shows where you are exposed. These services close the gaps and keep them closed.
Deeper reading from our knowledge base.
Serving businesses with 10 to 500 users nationwide, with deepest engineering capacity across NJ, NY, PA, and FL.
The next step is a short scoping call, followed by a quote and a proposed testing schedule.