Does NYDFS Part 500 require a penetration test? +
Section 500.05 requires covered entities to conduct penetration testing of their information systems at least annually, based on the risk assessment, unless they qualify for and document a continuous monitoring alternative. The scope of that testing is driven by your own risk assessment — Part 500 doesn't hand you a checklist of what to test. An external attack surface pentest covers the internet-facing portion of that obligation and gives you dated evidence to put in front of your examiner.
Will this report satisfy a NYDFS examiner? +
Our reports use an evidence-oriented format that documents scope, the assets tested, findings, and the date of testing, plus a signed Compliance Attestation Letter confirming the engagement. Examiners — and your CISO, who has to stand behind the annual certification — are looking for proof that testing actually happened against a defined scope and that findings were tracked to remediation. That's exactly what the deliverable is built to show. The sample report above is the exact format you'll receive.
How long does a NYDFS pentest take? +
For a covered entity with a typical external attack surface, the testing window is one to three business days of active testing, plus reporting. Most customers have a final report in hand within two weeks of purchase. If your annual certification deadline is close, choose the ASAP option in the order form and we'll start almost immediately.
What's "in scope" for a NYDFS external pentest? +
Anything you list with a public IPv4 or IPv6 address — web apps, customer and partner portals, APIs, mail, DNS, and especially your firewalls, VPNs, and remote-access gateways. Because Part 500 scope is risk-assessment-driven, you decide what goes in. We strongly recommend including perimeter and remote-access devices — over the past two years we've seen a sharp uptick in attackers reaching into financial-services networks through exactly those devices, and we frequently find critical issues there.
Why are you cheaper than a boutique or Big 4 pentest? +
Most external network pentests are repeatable, well-defined work. They benefit from a senior tester following a rigorous process. They do not benefit from a sales process, a custom SOW, or a tiered platform. We removed the sales overhead, published the pricing, and pass the savings on. The testing itself is the same quality you'd get from a premium firm — just without the procurement drag and the consulting-rate markup.
Do I need to schedule a call with sales? +
No. You select your scope from the published pricing table, complete checkout, and we begin. If you have a question that's actually blocking the order, email
hello@pentestexpress.com — but most teams move straight from pricing to purchase.
Can our procurement and vendor-management teams approve this without a custom SOW? +
Yes — that's the design. Pricing is fixed and published. The standard authorization and rules-of-engagement are in our
Terms of Service. For most covered entities this is short enough that vendor management and procurement can clear it without a multi-week negotiation cycle.
What if I need a retest after remediation? +
We retest everything from scratch, not just the listed findings. New issues that surfaced since the original engagement get reported too. Free retest within 14 days of report delivery. From day 15 through day 60, retest is 25% of the original test price. After 60 days, a full re-engagement is recommended because the environment has typically drifted enough that a fresh test is the honest answer.
What happens if you find something critical? +
We notify your designated emergency contact immediately and pause testing if appropriate. We don't bury critical findings until the final report — you'll know about anything urgent in real time, with enough detail to start remediation while testing continues. For a regulated financial institution, that early warning matters.
