Penetration testing
Find your vulnerabilities before an adversary does.
Network, application, API, and AI testing by Sidechain engineers. You get a report with evidence for each finding, a call where the testers walk your team through it, and a retest after you fix things.
Sidechain’s pen test uncovered three critical vulnerabilities our previous vendor missed entirely. The remediation plan was clear, prioritized, and our team had everything fixed within two weeks.
Scope
What we test.
Targets, access levels, and testing boundaries are agreed before work begins. Testing combines automated tooling with hands-on investigation; engineers review findings in context and validate impact within the authorized scope.
External network
Internet-accessible infrastructure, exposed services, misconfigurations, and exploitable weaknesses, as an outside attacker sees them.
Internal network
What an attacker could reach from an agreed internal position: exposed services, access controls, segmentation, privilege boundaries, and lateral-movement paths.
Web applications
Authentication, authorization, session management, input handling, and business logic. OWASP Top 10 and beyond, unauthenticated and authenticated.
APIs
REST and GraphQL authentication, authorization, input handling, and access to sensitive data, independent of any front-end interface.
Authenticated & privilege escalation
Testing with valid credentials to evaluate role boundaries, privilege escalation vectors, and access between users or tenants.
AI systems
Chatbots, agents, copilots, and LLM integrations tested for prompt injection, guardrail bypass, data leakage, and unauthorized tool use.
AI red teamingDeliverables
What you get.
Every engagement delivers detailed technical findings with CVSS scoring, proof-of-concept evidence, and screenshots; an executive summary suitable for leadership and board reporting; and a remediation roadmap ordered by severity and effort.
Then we get on a call. The engineers who performed the test walk your technical and leadership teams through every finding, the evidence, the testing limitations, and the practical priorities. A validation retest of remediated findings is included in every engagement.
- Technical findings with CVSS scores and evidence
- Executive summary for leadership and insurers
- Prioritized remediation roadmap
- Live technical debrief
- Retest of remediated findings included
What set Sidechain apart was the debrief. They didn’t just hand us a PDF. They walked our engineering team through every finding and helped us understand the real-world impact.
We needed a pen test to satisfy our cyber insurance renewal. Sidechain scoped it, executed it, and delivered the report in under three weeks. Our carrier accepted it without question.
Process
From scoping call to retest.
Scoping call
We review your environment, select a configuration, and define the target list together. Share your deadline and any insurer, auditor, or customer request.
Statement of work
Formal scope, timeline, rules of engagement, and pricing delivered within 48 hours of scoping for your review.
Testing
Active testing conducted within an agreed window, with communication contacts, operational constraints, and escalation arrangements established before we begin.
Report & debrief
Findings report, executive summary, and live debrief delivered within five business days of test completion.
Retest
Validation retest of remediated findings under the agreed scope and window.
Configurations
Four standard configurations.
Cost follows the number and complexity of targets, and each component is quoted separately. Pick the one that matches what you need tested.
External network
All internet-facing IPs within a defined range. Standard external pen test methodology. Best for a compliance-driven annual test or infrastructure-focused risk.
External + web application
External network test plus a pen test of one primary web application without credentials. Best for organizations with a main customer-facing app.
External + authenticated app
External network test plus authenticated testing of one application, including privilege escalation and role-based access. Best for apps with user logins and sensitive data.
Multi-application / API
External network test plus authenticated testing across multiple applications and API surfaces. Scope determined during the scoping call. Best for complex environments.
Compliance
Where testing is required.
Several frameworks require or recommend penetration testing, and insurance carriers increasingly ask for it at renewal. Tell us which one is driving the request so the report covers what they will look for.
- PCI-DSS
- Requirement 11.4: external and internal penetration testing.
- HIPAA
- Security Rule risk analysis and technical safeguard validation; annual testing under the proposed rule.
- SOC 2
- Trust Services Criteria for vulnerability management and monitoring.
- NY-DFS Part 500
- 500.05: penetration testing requirements for covered entities.
- Cyber insurance
- Many carriers require or incentivize annual penetration testing. Share the specific request so we can scope the right evidence.
- NIST CSF
- Identify and Protect functions, validated through simulated attack.
Testing does not itself certify compliance or guarantee a third party’s acceptance.
FAQ
Questions before you scope.
How does this differ from a vulnerability scan?
Automated tooling supports discovery and coverage. Engineers investigate findings, review access and application context, and validate exploitation or impact where authorized and safe. The report documents evidence, testing limitations, and remediation recommendations.
Will testing affect production systems?
Active testing carries operational risk. We agree on testing windows, exclusions, communication, and rules of engagement. Flag critical systems and operational constraints during scoping so those boundaries can be planned. Zero disruption is not guaranteed.
How long does an engagement take?
Timing depends on scope, access preparation, and availability. Share your deadline when you inquire. We agree on the testing and reporting schedule before work begins.
Who performs the testing?
Sidechain’s own engineers, in-house, in Portland, Oregon. You can discuss the findings directly with the people who performed the assessment.
What happens after the findings are delivered?
We walk through the findings and remediation priorities with your team. Retesting validates remediated findings under the agreed scope and window. New systems or further assessments can be scoped separately.
Request a penetration test.
Free scoping call. Statement of work within 48 hours. Retest included in every engagement.
(503) 389-3174 · info@sidechainsecurity.com · Portland, Oregon