Skip to content
Invadel

Independent Testing

Third-Party Penetration
Testing

Pentests from $4,000, fixed scope, free retest included. See all pricing →

Get a Fixed Quote

Three fields. A senior tester reads it and replies within one business day.

Prefer the full scoping questionnaire? 
OSCP & OSCE3 certified testers150+ years combined experienceOnboarding within 24 hoursFree retest includedOur methodology

When you need it

When someone else needs to see the test

The situations that bring teams to this engagement, and where it fits alongside the rest of your program.

  • A SOC 2 auditor asks for penetration testing evidence and expects it from a firm independent of your engineering team.
  • A PCI DSS assessor needs Requirement 11.4 testing by a qualified resource with organizational independence.
  • An enterprise customer’s security questionnaire asks for the date, scope, and provider of your last third-party penetration test.
  • A cyber insurance application or renewal asks whether an independent test was performed in the last twelve months.
  • A regulator or examiner, under NYDFS 500.5 or a similar rule, wants testing by a qualified internal or external party with evidence to match.

The requesting parties

Who requires a third-party penetration test

Few rules use the exact words “third party”. Most describe independence, and the parties reading your evidence apply that standard whether the rule spells it out or not.

Auditors and assessors

SOC 2 auditors look for testing by a firm independent of the engineering team. PCI DSS Requirement 11.4 allows a qualified internal resource or an external third party, provided the tester is organizationally independent of the systems under test. ISO 27001 auditors expect technical testing evidence they can rely on.

Customers and partners

Enterprise security questionnaires ask for the date, scope, and provider of your last penetration test and often for the summary or the attestation letter. A test by your own developers rarely passes that review; a test by the MSP that runs your network is questioned too.

Insurers and regulators

Cyber insurance applications ask whether an independent test was performed in the last twelve months. NYDFS 500.5 requires annual testing by a qualified internal or external party. Federal programs such as FedRAMP go further and require an accredited independent assessor.

What we test

What an independent test covers

Third-party testing is defined by who does it and who receives it, not by a narrower scope. Every target below is tested to the same depth as our core engagements, and every one comes with the attestation letter.

Web applications & APIs

The product your customers log into, tested with real accounts across every role, and the API behind it.

We test for

  • Authorization across roles and tenants
  • Authentication, session, and token handling
  • Injection and server-side flaws
  • Business logic and workflow abuse
  • Coverage mapped to OWASP Top 10 and API Security Top 10

External network

Everything you expose to the internet, discovered and tested the way an outsider would.

We test for

  • Asset discovery beyond the inventory
  • Exposed services and remote access
  • Credential attacks within agreed rules
  • Mail, DNS, and certificate configuration
  • Proof of exploitation for serious findings

Internal network & Active Directory

How far an attacker with a foothold can travel, delivered remotely through a shipped device or VPN.

We test for

  • Paths from a standard user to Domain Admin
  • Credential reuse and relay
  • Segmentation between zones and enclaves
  • Legacy hosts and protocols
  • Hybrid identity links to the cloud

Cloud environments

AWS, Azure, and GCP accounts tested for the identity and configuration paths that lead from one key to everything.

We test for

  • IAM privilege escalation paths
  • Public storage and exposed services
  • Kubernetes and serverless workloads
  • Secrets management and key exposure
  • Logging and detection gaps

Mobile applications

iOS and Android apps and the back end they call, including what a determined user can extract from the device.

We test for

  • On-device storage of tokens and personal data
  • Certificate pinning and platform protection bypasses
  • Reverse engineering for embedded secrets
  • API authorization from the mobile client
  • Deep links and inter-app communication

People & process

Phishing, vishing, and pretexting campaigns that measure whether your controls survive contact with a persuasive stranger.

We test for

  • Email, voice, and SMS campaigns with metrics
  • Adversary-in-the-middle scenarios against MFA
  • Pretexts tailored per department
  • Reporting rates and response times
  • Recommendations for training and controls

Independence is a property of the tester

What makes a penetration test independent

A test is third-party when the people performing it had no hand in building, configuring, or operating the systems under test and have no stake in the result. That excludes your developers, your internal security team when they run the systems, and in most reviewers’ eyes the managed service provider that administers your network, because a provider testing its own configuration is grading its own work.

Invadel’s testers are senior in-house employees, OSCP and OSCE3 certified, who do nothing but offensive testing. We do not build software, run networks, or sell the remediation, so the report has no reason to be kind or unkind. The attestation letter states that independence in plain terms, alongside the scope, the dates, the standards, and the outcome, which is what the party who asked for a third-party test actually needs to file.

Questions worth asking any provider

How to evaluate a third-party tester

  • Who performs the testing, are they employees, and what certifications do they hold? Ask for the names of the testers on your engagement.
  • Is every finding verified by hand, and does the report show the evidence? A scanner export with a cover page is not a penetration test.
  • What exactly does the attestation letter say, and will the auditor or customer accept it? Ask for a sample before you sign.
  • Is the price fixed and published, or will scope creep turn into invoices? Ours are on the pricing page.
  • Is a retest included, and how quickly? Serious findings that stay open undo the value of the test.
  • Our guide on how to choose a penetration testing company and our RFP template cover the rest.

Methodology

How we test

Full methodology →

Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.

These are the phases your Third-Party penetration testing runs through.

  1. 01

    Scope with the recipient in mind

    We ask who will read the evidence and what they need to see, then scope the test so the report answers their question the first time.

  2. 02

    Test to named standards

    OWASP for applications, PTES and NIST SP 800-115 for the engagement structure, MITRE ATT&CK for network and adversary work, so the methodology can be cited.

  3. 03

    Verify every finding

    Each finding is proven by hand with evidence. Nothing enters the report on the strength of a scanner.

  4. 04

    Report for three audiences

    Engineers get reproduction steps, leadership gets the executive summary, the third party gets the attestation letter and a shareable summary.

  5. 05

    Retest and re-attest

    A free retest once fixes ship, and an updated letter that shows the serious findings are closed.

How it works

How your engagement runs

From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.

  1. 01

    Scope & kickoff

    Targets, roles, and rules of engagement defined in writing, with a fixed scope and timeline.

  2. 02

    Testing goes live

    Findings post to your live platform dashboard the moment our testers confirm them.

  3. 03

    Track remediation

    Follow every finding from open to fixed, with severity, evidence, and status in one place.

  4. 04

    Report & retest

    Executive and technical reports land, then request a free retest in one click.

Compliance

Compliance frameworks this test satisfies

Findings are mapped to the requirement or control they evidence, so the same report serves your auditor, your customers, and your engineers.

SOC 2Independent testing evidence for the Security criteria, with findings mapped to controls and an attestation letter for the audit file.PCI DSSRequirement 11.4 testing by a qualified resource with organizational independence from the systems under test.NYDFS 23 NYCRR 500Section 500.5 testing by a qualified internal or external party, documented for the annual certification.ISO 27001Independent technical testing evidence for the ISMS and its Annex A controls.HIPAATechnical evaluation evidence for the Security Rule from a party outside the covered entity’s own IT function.

Proof

Proof in the field

Every engagement is confidential, so the work below is anonymized to sector and engagement type. The findings and outcomes are real.

All case studies →

Free

Retest on every penetration test

150+

Years combined experience

13

Senior in-house specialists

24h

Onboarding after signing

HR & Payroll SaaS

Web Application Penetration Test

High risk

Critical: a file-inclusion flaw that let an attacker read sensitive files from the server through the application itself. High: stored cross-site scripting capable of session theft, insecure direct object references, and an authorization bypass that let an administrator create or delete organization owners.

Outcome. Delivered a remediation plan sequenced by real business impact, critical and high findings first, with a complimentary retest to verify every fix.

28

Findings

1

Critical

5

High

Read the case study

Fintech · Payments

Web Application Penetration Test

High risk

Critical: a remote code execution flaw in the application’s web framework that could have given an attacker full control of the server. We escalated it to the development team while the test was still running.

Outcome. The critical RCE was reported and remediated during the engagement via an emergency framework upgrade, which also closed the server-side request forgery, and the remaining findings were retested to confirmation.

1

Critical (RCE)

Mid-test

Critical remediated

2

High

Read the case study
DTCCCity National BankBrewDogLuluEmeriaIP Telecom
Request a reference 

Resources

Field notes from the offensive side

All articles →

How to Choose a Penetration Testing Company

What separates good penetration testing companies from bad ones: certifications, methodology, reporting, retesting, and the questions to ask before you sign.

Penetration Testing RFP Template: 25 Questions to Ask Vendors

A usable penetration testing RFP template: sections to include, 25 vendor questions grouped by theme, and what a good answer to each looks like.

SOC 2 Penetration Testing Evidence Checklist: What to Hand Your Auditor

The evidence a SOC 2 auditor expects from your penetration test: scope, report, remediation, retest, attestation letter, and the criteria each item maps to.

Want to see a real report first?

Request a redacted sample report before you scope an engagement, or read what a penetration testing report should contain.

Request sample report

FAQ

Frequently asked questions

What teams most often ask before scoping Third-Party penetration testing.

Still have questions? 
01What is a third-party penetration test?

A penetration test performed by a firm that is independent of the people who built and operate the systems under test, and documented so that an outside party such as an auditor, a customer, an insurer, or a regulator can rely on it. The test itself is the same manual, evidence-based work as any Invadel engagement; the difference is the independence of the tester and the attestation that comes with the report.

02Does SOC 2 require a third-party penetration test?

The SOC 2 criteria do not use those words, but auditors expect penetration testing evidence and expect it to come from a party independent of the engineering team, because a self-assessment is weak evidence for the Security criteria. A dated report and attestation letter from an independent firm is what nearly every SOC 2 audit file contains.

03Can our MSP or IT provider do the penetration test?

For PCI DSS the tester must be organizationally independent of the systems under test, and a provider that administers your network is testing its own configuration. Most auditors, customers, and insurers apply the same logic even where the rule is silent. Using an independent firm removes the question, and it usually finds what the provider’s own assumptions hide.

04What is an attestation letter?

A one- or two-page document on Invadel letterhead stating what was tested, when, by whom, against which standards, and the status of the findings at the close of the engagement including the retest. It does not disclose the findings themselves, which makes it safe to send to customers, insurers, and partners who need proof that a real test happened.

05What will an enterprise customer accept?

Typically the attestation letter, a summary version of the report with severities and remediation status but no exploit detail, and sometimes the full report under NDA. We produce all three. Customers also want to see that critical and high findings were fixed and verified, which is why the free retest matters.

06How much does a third-party penetration test cost?

The same fixed prices as every Invadel engagement, because independence is not a surcharge: API testing from $4,000, external network from $4,200, web application from $5,200, internal network from $6,000, cloud from $6,800. The attestation letter, the shareable summary, and the retest are included.

07How quickly can we have evidence in hand?

Onboarding starts within 24 hours of a signed proposal and testing usually begins within a week. A single application or perimeter test typically completes within one to two weeks, and the attestation letter is issued with the report. If an audit or a customer deadline is fixed, tell us the date and we schedule to it.

08Do you sign NDAs and handle the evidence carefully?

Yes. We sign your NDA or provide ours, agree rules of engagement in writing, handle findings and evidence through the platform rather than email, and destroy testing artifacts on the schedule set in the engagement terms.

Ready to test your defenses?

Talk to our team about scoping Third-Party penetration testing.

Prefer the full scoping questionnaire? 
RelatedWeb App External Network PTaaS

Get a Fixed-Scope Quote

Tell us what you need tested. We reply within one business day.