Penetration testing for small businesses: cost, the law and how to choose a provider

A major customer sends over its security questionnaire: “Date of your last penetration test? Please attach the executive summary.” You start looking for a provider and find offers that are impossible to compare, from an automated scan delivered in a day to an engagement lasting several weeks. This guide helps you buy the right test, frame it without legal risk and get something useful out of it.

A penetration testPenetration testing (pentest)A simulated attack, carried out by authorised specialists, to find the weaknesses in a system before a real attacker exploits them., or pentest, means asking specialists to play the attacker, with your written consent, to find out what a real intruder could reach. The stakes are concrete: exploiting a vulnerability is still the most common way in.

Scan, pentest, red team, bug bounty: don’t buy the wrong thing

These four approaches are often confused, sometimes deliberately in sales pitches. They answer different questions.

A red teamRed teamAn exercise in which a team of authorised attackers imitates a realistic adversary over several weeks to test the organisation’s ability to detect and respond to an attack. pursues a specific goal (reaching the payment system, say) without warning your staff, to test detection as much as prevention. A bug bountyBug bountyA programme in which an organisation invites security researchers to look for flaws within a defined scope, and rewards them for each valid vulnerability reported. opens a scope to independent researchers who are paid only for valid findings. For most small businesses, the right pairing is a regular scan plus an annual penetration test.

Black, grey or white box: where to start?

Before the engagement, you decide how much the testers know at the outset: black, grey or white boxBlack, grey and white box testingHow much information testers receive before an audit: nothing (black box), a user account or partial documentation (grey box), or everything, source code included (white box)..

• Black box: no information, like an outside attacker. Realistic, but part of the budget goes on discovery.
• Grey box: a standard user account and a few architecture details. For a small business this is often the best value: it also covers what a malicious customer or an employee with a stolen account could do.
• White box: documentation, configuration, sometimes source code. Less realistic, but coverage is at its widest.

The law in France: written authorisation first

The only thing separating a penetration tester from a criminal is authorisation. It must be in writing, signed by someone with genuine authority over the systems (the managing director or a named delegate), and come with two documents:

• the contract: responsibilities, confidentiality, insurance and what happens to data collected during the test;
• the rules of engagementRules of engagement (scope and mandate)A signed document setting out what a tester is allowed to do: target systems, dates, permitted and forbidden techniques, emergency contacts and what to do if something unexpected happens.: exact scope (domains, addresses, applications), dates and hours, the testers’ source addresses, prohibited actions (denial of service, deleting data, social engineering unless agreed) and emergency contacts on both sides.

Watch out for third parties. If your website sits with a host or your software with a SaaS vendor, you can only authorise what you own or what your contract lets you have tested. Major cloud providers publish their rules: AWS, for instance, allows tests on a list of services without prior approval but bans any denial of service. Read those rules and attach them to the contract. Our chapter on ethical hacking and the law covers the full legal picture.

A typical engagement, step by step

1. Scoping. Objectives, scope, level of information, timetable, contacts. Name an internal lead and check your backups.
2. Reconnaissance. The testers map what is visible: subdomains, exposed services, technologies, public information about the company.
3. Testing. They check which weaknesses are real and exploit them just enough to prove the impact, without breaking anything or taking real data. A critical flaw should be reported to you straight away, not saved for the report.
4. Report. An executive summary, then the detail of each vulnerability with evidence and recommendations.
5. Debrief. A meeting with management and technical staff to explain, prioritise and answer questions.
6. Retest. Once you have fixed things, the testers check the holes are really closed. Without this step you don’t know whether the fix works.

The testing itself takes from a few days for a single website or application to a few weeks for a full internal and application scope. Allow for scoping before and the retest after.

How much does a penetration test cost?

There is no official price list: ANSSI, the French national cybersecurity agency, qualifies providers but publishes no rates, and the ranges you find online come from providers themselves and vary widely. Keep one formula in mind: price = number of person-days × day rate. The number of days is what moves most.

The PASSI qualification: what it is and when to require it

PASSI stands for “prestataire d’audit de la sécurité des systèmes d’information”, France’s qualification for information security audit providers, awarded by ANSSI after assessment. The current baseline (version 2.2, published on 29 November 2024) covers five activities: architecture, configuration and source code audits, penetration testing, and organisational and physical audits. It has two levels, substantial and high.

When is it mandatory? For inspections of the information systems of operators of vital importance (OIV, France’s critical infrastructure operators) ordered by the Prime Minister: under article L1332-6-3 of the French Defence Code, these are carried out by ANSSI, by designated State services or by qualified providers. It is also frequently required in public tenders or by contract. In finance, the EU’s DORA regulation separately requires entities designated by their authority to run threat-led penetration tests at least every three years, under its own rules.

For a small business with no such constraint, the qualification is not compulsory, but it guarantees a method, a contract and data handling you should expect from any provider. ANSSI publishes the list of qualified providers on cyber.gouv.fr. To be clear: KrakenShield is not PASSI-qualified.

Reading the report: CVSS and prioritisation

Start with the executive summary: in one page, it should say what an attacker could reach and name the three or four priority workstreams. Each vulnerability is then scored, usually with CVSSCVSS (severity score)A scoring system from 0 to 10 that measures the technical severity of a vulnerability, based on criteria such as how easy it is to exploit and its impact on data and service. (version 4.0, published on 1 November 2023): low from 0.1 to 3.9, medium from 4.0 to 6.9, high from 7.0 to 8.9, critical from 9.0 to 10.

CVSS measures technical severity, not your risk. To decide the order of fixes, ask three questions:

• Is it exposed? A flaw reachable from the internet comes before an internal one.
• Is it being exploited? The EPSSEPSS (exploit prediction)A score published by FIRST that estimates, between 0 and 1, the probability that a published vulnerability (CVE) will be exploited in the next 30 days. score estimates the probability of exploitation within 30 days, and the KEVKEV (known exploited vulnerabilities)A public catalogue run by CISA, the US cybersecurity agency, listing the vulnerabilities that attackers are confirmed to have exploited. catalogue from the US agency CISA lists flaws already exploited in the wild.
• What sits behind it? A flaw on payroll or production weighs more than one on a demo server.

Questions to ask a provider

• Who will do the testing? Names, experience with a scope like yours, hands-on certifications.
• Are you PASSI-qualified, and for which activities? (Check ANSSI’s list.)
• Which method do you follow, and can you show an anonymised sample report?
• Does the quote break down days per activity, the debrief and the retest?
• What happens if you find a critical flaw mid-engagement?
• Which actions are excluded to protect production?
• Where is collected data stored, who can access it, and when is it destroyed?
• Do you hold professional liability insurance that covers testing?
• Are you independent from the company that installed or maintains our systems?
• Which source addresses will you test from, so we can recognise you in our logs?

Between two pentests

A penetration test is a snapshot on a given date. In between, new flaws are published every week and your systems change. KrakenShield’s non-destructive penetration test, launched from the console on a domain whose ownership you have proved and under your authorisation, lets you replay reconnaissance and vulnerability discovery after every fix (see what it covers). It complements a manual pentest; it does not replace one on a critical scope.

Also prepare for the day an attacker gets through anyway: our article Ransomware attack: what to do covers the first hours. For more on methods, standards and testing frequency, read the chapter Penetration testing from A to Z.