Westchester County Penetration Testing Services

Every engagement is fixed-scope and fixed-price, agreed before work starts: external network testing from $4,200, web application testing from $5,200, and internal network testing from $6,000. On-site work in Westchester carries no travel premium.

Yes. White Plains is under an hour from our Manhattan office by Metro-North or car, and Yonkers and New Rochelle are closer still. Internal network testing, physical assessments, and in-person readouts are routine across the county, and every engagement can also run remotely.

Usually with a web application penetration test, since your product is what enterprise security reviews scrutinize first, sometimes paired with an external network test. We deliver reports formatted for SOC 2 auditors and enterprise questionnaires, plus an attestation letter you can share instead of the full report. Onboarding begins within 24 hours of a signed proposal and testing typically starts within a week, so a deal deadline can usually be met.

If your company is licensed or regulated by the New York Department of Financial Services, yes. The regulation follows the license, not the office, so a White Plains bank or the Westchester back office of a Manhattan financial firm is typically in scope. We scope, test, and report to its annual penetration testing requirement.

Yes. We test the perimeter from outside and the internal network from a branch workstation, run phishing campaigns for the staff who approve payments, and test vendor-hosted online banking with the vendor’s authorization. Reports tie each finding to your risk assessment and read the way FFIEC and NYDFS examiners expect.

Yes. We test the patient portals, EHR integrations, billing systems, and internal networks that hold protected health information. That covers health systems, physician groups, and health tech companies across the county, from Yonkers and New Rochelle to Mount Kisco. Reports map to the HIPAA Security Rule and the NY SHIELD Act, and for general hospitals to the annual penetration test in New York’s hospital cybersecurity regulation, 10 NYCRR 405.46.

Yes. Advisers and family offices are tested where client money and client data actually move: the Microsoft 365 or Google Workspace tenant, the client portal and document vault, and the service staff who take distribution and bank-change requests by phone. Single-family offices that meet the SEC’s family office rule sit outside Regulation S-P, but the SHIELD Act still lists regular testing of key controls among the safeguards for any business holding New York residents’ private information.

Not by name. The SHIELD Act requires any business holding the private information of New York residents to maintain reasonable administrative, technical, and physical safeguards. Its technical safeguards include regularly testing the effectiveness of key controls, and a penetration test is the clearest evidence that those controls work. We deliver that evidence in a form counsel, insurers, and regulators can read, for school districts, nonprofits and foundations, law firms, and banks across the county.