[ Security ]
What is penetration testing, and does a small business need it?
By REM Strategic Services · Updated
[ Quick answer ]
A penetration test is an authorized, hands-on attempt to find and prove security weaknesses in systems you own, done by a person, not just a tool. A small business may want one if it takes card payments online, stores customer data, runs custom software or an app, or has a customer, insurer, or partner asking for it. If you have a simple brochure site on managed hosting, the basics usually come first: updates, multi-factor login, backups, and limited account access.
What penetration testing is
A penetration test, or pen test, is a security assessment where a tester looks for weaknesses the way a real attacker might, then shows you what they found and how serious it is.
It's done only with permission, only on systems you own or are allowed to have tested, and only within a written scope. The goal is to find problems before someone else does, and give you a clear list of what to fix first.
How it differs from a vulnerability scan
A vulnerability scan is automated. A tool checks your systems for known issues and produces a list. Scans are useful and worth running regularly, but they can miss problems and flag things that aren't real risks.
A pen test is done by a person. The tester confirms which issues are real, looks for problems a tool can't see, like flaws in how your app handles logins or permissions, and explains the actual risk to your business.
| Vulnerability scan | Penetration test | |
|---|---|---|
| Who does it | Automated tool | A person, using tools and judgment |
| What it finds | Known, common issues | Known issues plus logic and permission flaws |
| False alarms | Common | Findings are confirmed |
| Output | A list of possible issues | A report with evidence and priorities |
| How often | Often, on a schedule | Before launch, after big changes, or when asked |
When a small business might want one
Not every business needs a pen test. These are the situations where it's worth a conversation.
- You take card payments online.
- You store customer data, like accounts, records, or files.
- You run custom software, a web app, an API, or a mobile app.
- You're about to launch something new and want it checked first.
- A customer, insurer, or partner asks for security testing.
- You've made a big change, like a new system, a move to the cloud, or a major update.
Some customers, insurers, and payment-card requirements may ask for security testing. We don't give legal advice. Check what your own contracts and obligations require.
When it's probably not the first priority
If you have a simple brochure website on managed hosting, with no logins, payments, or stored customer data, a pen test probably isn't where your money should go first.
Start with the basics. They prevent a lot of common problems and cost little or nothing.
- Keep software, plugins, and devices updated.
- Turn on multi-factor login for email, hosting, banking, and anything with admin access.
- Keep backups, and check that you can restore them.
- Give each person only the access they need, and remove it when they leave.
What a scope and rules of engagement are
Before any testing starts, you and the tester agree in writing on what will be tested and how. Nothing starts until you approve it.
The scope lists exactly what's included, like a specific web app, API, network, or cloud account you control, and what's off limits. The rules of engagement cover when testing happens, who to contact, how to handle anything urgent, and what the tester will and won't do.
You must own the systems or have written permission to have them tested. If a system is run by a vendor, they may need to approve it too.
What you get at the end
The deliverable is a confidential report. Each finding is ranked by risk, backed by evidence, and paired with what to fix and in what order. It's written so you can act on it, not just file it.
After you've made fixes, a retest can confirm they worked. At REM, security testing is quoted per scope, and the first conversation is free. We also do security-focused code review and reverse engineering under the same rules.
A pen test shows what was found within the scope at the time of testing. It can't prove a system has no weaknesses.
[ Prices ]
What REM charges for security testing
- Penetration testing (web apps, APIs, networks, cloud you control)Quoted per scopeOnly for systems you own or have written permission to assess.
- Retest after fixesQuoted per scopeAvailable as a follow-on.
- First conversationFree
[ Common questions ]
Questions owners ask
- Is a vulnerability scan the same as a penetration test?
- No. A scan is automated and lists possible issues. A pen test is done by a person who confirms what's real, finds issues tools miss, and explains the risk.
- Does my small business legally need a penetration test?
- It depends on your situation. Some customers, insurers, and payment-card requirements may ask for security testing. Check your own contracts and obligations. We don't give legal advice.
- Can you test a system I don't own?
- Only with written permission from whoever owns or runs it. Nothing starts until a written scope and rules of engagement are approved.
- How much does a penetration test cost?
- It depends on what's being tested. We quote per scope after a free first conversation.
- Will testing take my website or app down?
- The rules of engagement set when and how testing happens, and who to contact if anything urgent comes up. That's agreed in writing before testing starts.
- What happens after I get the report?
- You fix the findings in order of risk. When you're ready, a retest can confirm the fixes worked.
[ Want it done for you ]
Start with a website that brings in calls.
Starter website for $999 — half now, half when it goes live. You own it. Starting from zero? Launch adds the Florida LLC.