What a penetration test actually tells you

Here is the part people get wrong most often, and it is the most common way this budget gets wasted.

A security scan is automated. Software checks your systems against a list of known weaknesses and gives you the list back. Nobody tries to use them.

A penetration test is a person. Someone we trust attempts to break in the way a criminal would, one step leading to the next, and then shows you how far they got and what they could have taken.

The scan tells you what might be open. The test tells you what it would actually cost you. You cannot fix what you cannot see, and the report is the product here, not the break-in.

What we test

• From the outside, the way anyone on the internet sees your business.
• From the inside, to show how far someone could travel once they are past the front door.
• Your websites and applications, including whether someone can reach an account or a record that is not theirs.
• Your cloud accounts, where most businesses now keep the things that matter.
• Your Wi-Fi.
• Your staff, with a realistic phishing test, if you want it included.
• The AI tools you have put into service.

You get a written report ranked by what to fix first, a short summary your board or your customer can read without a technical background, and a retest.

Testing the AI tools your business has started using

If you have put an assistant, a chatbot, or anything that answers customers into service in the last year, it is now one more way into your business, and almost nobody is testing it.

These systems break differently from the rest of your business. Someone can talk one into ignoring the rules it was given. They can coax it into repeating information it was supposed to keep private, including things about other customers. They can feed it a message that changes what it tells the person who asks next.

We test for that, on the same engagement as everything else. We built our own technology for this because the usual tools cannot do it, and it means you do not need a second vendor to cover the newest part of your business. It sits alongside our AI security work.

What it costs, and what changes the price

We do not publish a flat rate, and you should be careful with anyone who quotes one before they have looked at your business. Scope drives the price, and a number given blind is usually a number that gets revised later.

Four things move it:

• How much there is to test. One website is not the same job as fourteen.
• How unusual it is. Something built for you takes longer than something off the shelf.
• Whether we test your staff as well as your systems. That is a separate piece of work.
• Whether a retest is included. Ours is. Fixing something without checking the fix leaves you trusting rather than knowing, so we treat it as part of the job and not an extra.

The scoping call is free and it is how you get a real number. We will also tell you when a cheaper vulnerability assessment is the better place to start, because sometimes it honestly is.

How long it takes

A focused test on your website or your external systems usually runs one to two weeks including the report. Larger businesses with several applications and an internal network take a few weeks. The reporting is not padding at the end. It is the part that changes anything.

Who runs your test

Ask this of anyone you are considering, including us.

Your test is carried out by OSCP-certified testers. OSCP is the credential that separates people who actually break into systems from people who run a scanner and forward the output. Our own team holds CISA and CISM on the assessment and governance side, along with Microsoft Azure, AWS, Cisco, Fortinet, Palo Alto and Check Point certifications across the systems most Canadian businesses run. Between the founders there is more than 45 years of experience.

Your results stay in Canada.

Penetration testing and Canadian rules

Most tests we run are triggered by a requirement rather than curiosity, so it is worth being exact about which one.

PIPEDA does not name penetration testing. It requires you to protect personal information with safeguards that match how sensitive it is. A test is one of the clearest ways to show those safeguards work, rather than assert that they do.

PHIPA applies if you hold Ontario health information and expects you to be able to demonstrate the controls you claim.

PCI DSS is direct about it. If you take card payments, Requirement 11.4 calls for regular penetration testing.

SOC 2 and ISO 27001 do not demand a test by name, but auditors routinely expect one as evidence.

Insurers increasingly ask whether you test before they set your premium.

Being straight about our role. We run the test and we write the report. We are not a certification body and we do not issue certificates, and any provider blurring that line is telling you something about themselves. What the report does is give the auditor, the insurer, or the customer the evidence they are asking you for.

Questions worth asking any provider

• Who is actually doing the testing, and what do they hold? Ask about the testers, not the salesperson.
• Can I see a sample report? A good one explains what it means for your business and what to do. A weak one is a list of reference numbers with a logo on top.
• Is a retest included? If not, ask the price now and count it as part of the quote.
• Where do our results live? That report is a map of how to get into you. Ask whether it stays in Canada.
• Can you test our AI tools? Most cannot yet. It is a fast way to find out how current a provider is.

Mistakes that waste the money

• Buying a scan and calling it a test. Different service, different price, different value.
• Testing once and treating it as permanent. A test describes the day it ran. Your business moves.
• Leaving out the systems you are nervous about. Those are the ones a criminal goes for first.
• Filing the report. Findings only reduce risk when somebody owns the fixes and finishes them.
• Skipping the retest. Without it you are trusting the fix worked instead of knowing.

Penetration testing FAQ

How much does a penetration test cost in Toronto? It depends on how much there is to test, so we quote after a short call rather than before. The price is driven by the number of systems, how unusual they are, whether we test your staff, and whether a retest is included. Be careful with a flat rate quoted before anyone has looked.

What is the difference between a penetration test and a security scan? A scan is software checking for known weaknesses and handing you a list. A penetration test is a person trying to use those weaknesses to get in, so you see the real consequence. Many businesses run a scan first, then test the areas that matter most.

How often should we test? At least once a year, and again after any significant change to your systems. Most frameworks expect that, and PCI DSS says it directly.

Will testing disrupt our business? No. Testing is scheduled around your operations and we stay in contact with your team throughout.

Can you test our AI assistant or chatbot? Yes. We test AI systems for the specific ways they fail, including being talked out of their own rules or into revealing information they should not. Most providers cannot do this yet.

Is penetration testing required by PIPEDA? PIPEDA does not name it. It requires safeguards appropriate to how sensitive your information is, and testing is how you show yours are effective. For card payments and for many customer contracts, regular testing is a firm requirement.

What do we get at the end? A report of everything found, ranked by what to fix first, in language your team can act on. A short summary for your board or your customer. And a retest confirming the fixes worked.

Serving Toronto, the GTA, and all of Ontario

We test businesses across Toronto, Mississauga, Markham, Vaughan, Hamilton, Ottawa, and the rest of Ontario. Pair testing with our vulnerability assessment and network security services so you get continuous cover instead of one snapshot a year. See all of our managed cybersecurity services.

Book a scoping call or call +1 (647) 948-6768.

Our guidance aligns with the Canadian Centre for Cyber Security.