Penetration testing
External, internal and web application tests that follow OWASP and PTES methods. You get proof of each issue, its business impact and exact fix steps, not a raw scanner dump.
Cybersecurity · San Jose, CA
Find the holes before attackers do.
Penetration testing, vulnerability management and secure code review for small and mid-sized businesses. Every engagement is run by a senior practitioner, and every finding is verified by hand.
engagement summary
scope external · 14 hosts · 1 web app
duration 5 days manual testing
findings 1 critical 3 high 6 medium
verified 10 / 10 reproduced by hand
retest included within 60 days
report executive summary + fix steps
Services
Vulnerability management
Authenticated scanning, triage and patch tracking, as a one-time assessment or a monthly service. We work with your existing scanner or bring free, proven tooling.
AI-assisted code review
AI-powered analysis covers the whole codebase quickly, then every reported issue is confirmed by hand before it reaches you. You get speed without false-positive noise.
Microsoft 365 security baseline
Lock down Entra ID, MFA, Conditional Access and email authentication using the licences you already pay for, before you buy more tools.
Advisory & retests
Hourly help for security questionnaires, vendor reviews, incident first response and verifying fixes.
Clear reporting
An executive summary for leadership, technical detail for engineers, and a walkthrough call. Retest within 60 days is included.
Starting prices
Fixed-fee quotes after a free 30-minute scoping call. Prices depend on scope; these are typical starting points.
| Service | Typical starting scope | From |
|---|---|---|
| External network pentest | Up to 16 public hosts, 3 days manual testing | $3,500 |
| Internal network pentest | Up to 50 hosts, remote, 4 days | $5,000 |
| Web application pentest | One app, 2 user roles, authenticated, 5 days | $6,000 |
| Vulnerability assessment | Up to 100 assets, prioritised fix plan | $2,500 |
| Managed vulnerability management | Monthly scans and triage, up to 100 assets | $600/mo |
| AI-assisted secure code review | Up to 25k lines, every finding verified | $2,500 |
| Microsoft 365 security baseline | Entra ID, MFA, email authentication | $2,000 |
| Advisory | Billed hourly | $150/hr |
How an engagement works
- ScopeA free call to agree the targets, goals and timing. You get a fixed-fee proposal.
- AuthoriseSigned agreement and written rules of engagement. No testing starts without them.
- TestManual testing backed by automation, with daily check-ins and immediate notice of anything critical.
- ReportVerified findings, risk ratings and fix steps, followed by a walkthrough call.
- RetestWe confirm your fixes within 60 days at no extra cost.
About PHINET
PHINET LLC is an independent cybersecurity firm based in San Jose. We bring hands-on experience in security operations, Microsoft Defender and Entra, Azure, Qualys and penetration testing to businesses that need real testing without enterprise overhead.
We use AI to cover more ground faster. A human tester verifies every finding, and your data is handled under a written data-handling policy, then deleted after delivery.
- Senior-ledThe person who scopes your test runs it.
- Verified findingsNo unconfirmed scanner output in reports.
- Data minimisedClient data deleted 90 days after delivery.
Request a scoping call
Tell us what you need tested and your timeline. We reply within one business day.
Emailsupport@phinets.com
Security reportssecurity.txt