How often should you do a penetration test?

At minimum annually, and after any significant change: a major release, a cloud migration, an acquisition, or new internet-facing infrastructure. Compliance frameworks such as PCI DSS and SOC 2 generally expect annual testing plus testing after material changes. Fast-moving environments pair an annual deep test with continuous attack surface management in between.

What is the difference between a penetration test and a vulnerability scan?

A vulnerability scan is automated software that flags known weaknesses; it is cheap, fast, and full of false positives. A penetration test is a human-led attack that validates which weaknesses are actually exploitable, chains them together, and demonstrates real impact. A scan tells you what might be wrong; a penetration test proves what an attacker can do about it.

What is red teaming and do we need it?

Red teaming is a goal-based, multi-week simulated attack — often covert — that tests whether your organization can detect and respond to an intrusion, not just whether individual systems are hardened. It is worth running once you have mature controls and a monitoring capability to test. If you have never had a penetration test, start there; red teaming an unhardened environment proves nothing you did not already know.

Do you retest after we fix the findings?

Yes. One retest of remediated findings within 90 days is included in every Blankpage penetration testing engagement, with an updated report suitable for auditors, customers, and boards. Retests beyond that window or scope are quoted plainly, in advance.

Penetration Testing & Red Teaming Services

Penetration testing services answer one question with evidence: can an attacker get in, and how far? We write reports engineers can fix from, not PDFs you shelve.

What Is a Penetration Test?

A penetration test is a controlled, authorized attack on an organization's systems, performed by security engineers using the same techniques as real adversaries to find exploitable weaknesses before criminals do. Unlike an automated vulnerability scan, a penetration test chains findings together, proves actual impact, and documents exactly how each weakness was exploited and how to close it.

Blankpage runs penetration testing services from Albuquerque, New Mexico, for clients across the United States. Human-led, every finding reproduced and evidenced, every severity ranked by real-world impact — not by scanner output.

The Problem: Most Pentest Reports Are Scans With a Logo

A large share of the penetration testing market resells automated scanner output under a cover page. You pay for expertise and receive a vulnerability list you could have generated yourself: no context, inflated severities, and no way to tell which of 400 line items actually matters.

We take the opposite position. Fewer findings, fully proven. Each one carries reproduction steps, business impact in plain language, and a specific fix. If your environment is in good shape, the report says so. We do not pad.

Scope: What We Test

- Web applications and APIs — authentication, authorization, injection, business-logic abuse. OWASP-aligned, then past it. - Cloud environments — IAM misconfigurations, exposed storage, privilege-escalation paths across AWS, Azure, and GCP. - External and internal networks — perimeter exposure, lateral movement, Active Directory attack paths. - Social engineering — phishing and pretexting campaigns, measured and reported without shaming individuals. - Red teaming — a goal-based, multi-week campaign that tests your detection and response, not just your controls. Rules of engagement in writing before anything starts.

Between tests, continuous attack surface management watches what you expose to the internet — so the annual test is not the first time you hear about a forgotten subdomain.

How Much Does a Penetration Test Cost?

As of 2026, a professionally executed penetration test in the United States typically costs between $5,000 and $50,000. A focused external network or single web application test usually lands between $5,000 and $15,000. A full-scope engagement covering web, cloud, and internal network runs $20,000 to $50,000. Multi-week red team operations start around $40,000. Anyone quoting a firm number before scoping is quoting a scan.

What moves the price: number of targets and endpoints, environment complexity, testing depth (scan-plus-validation versus full manual exploitation), compliance-driven reporting requirements, and retest coverage. We publish the factors because the alternative is pricing theater.

Process, Deliverables, and Retest Policy

Scoping call and written rules of engagement in week one. Testing runs one to three weeks depending on scope, with immediate out-of-band notification for any critical finding — we do not sit on an exploitable remote-code-execution until the report ships. You receive an engineer-written report: executive summary, attack narrative, evidenced findings with reproduction steps and fixes, and a severity model tied to your business.

One retest of remediated findings within 90 days is included in every engagement, with an updated report you can hand to auditors and customers. The report, the evidence, the methodology notes — all of it is yours. Full IP transfer, no lock-in.

After the Test

Findings are only useful if they get fixed. Remediation can run through our cybersecurity practice, and if testing uncovers signs of an active compromise, incident response takes over the same day. Acquirers use the same offensive team inside technical due diligence when a target's security posture is part of the price.

Start with a scoping call, or fold the test into a broader engagement. Two weeks from scoping to testing in most cases.

Frequently asked questions

How much does a penetration test cost?: As of 2026, penetration testing services in the United States typically cost $5,000 to $50,000. Focused single-scope tests run $5,000 to $15,000, full-scope engagements run $20,000 to $50,000, and red team operations start around $40,000. Price is driven by target count, environment complexity, testing depth, and reporting requirements — which is why credible firms scope before quoting.
How often should you do a penetration test?: At minimum annually, and after any significant change: a major release, a cloud migration, an acquisition, or new internet-facing infrastructure. Compliance frameworks such as PCI DSS and SOC 2 generally expect annual testing plus testing after material changes. Fast-moving environments pair an annual deep test with continuous attack surface management in between.
What is the difference between a penetration test and a vulnerability scan?: A vulnerability scan is automated software that flags known weaknesses; it is cheap, fast, and full of false positives. A penetration test is a human-led attack that validates which weaknesses are actually exploitable, chains them together, and demonstrates real impact. A scan tells you what might be wrong; a penetration test proves what an attacker can do about it.
What is red teaming and do we need it?: Red teaming is a goal-based, multi-week simulated attack — often covert — that tests whether your organization can detect and respond to an intrusion, not just whether individual systems are hardened. It is worth running once you have mature controls and a monitoring capability to test. If you have never had a penetration test, start there; red teaming an unhardened environment proves nothing you did not already know.
Do you retest after we fix the findings?: Yes. One retest of remediated findings within 90 days is included in every Blankpage penetration testing engagement, with an updated report suitable for auditors, customers, and boards. Retests beyond that window or scope are quoted plainly, in advance.