External
Internet-facing systems
Everything you expose to the internet: firewalls, VPNs, remote access, websites and email.
Penetration testing
Penetration testing in Portland
Every test ends with a report that shows what we got into, how we did it and how to fix it. You walk through it with the tester who did the work.
Internal
Your office network
What an attacker could reach after one phishing click or a stolen laptop.
Apps
Web apps and APIs
Customer portals, booking and payment pages, and the APIs behind them.
Cloud
Microsoft 365, Google, AWS, Azure
Settings that leak data or let an attacker sign in from anywhere.
People
Phishing
Realistic emails to your staff, with short training for anyone who clicks.
Wireless
Wi-Fi
Office and guest Wi-Fi, and whether one can reach the other.
Every month
Security that keeps running after the test
A test is a snapshot. These are the controls that keep you covered between tests.
- Endpoint protection with 24/7 monitoring. A security operations center watches your laptops and servers around the clock and isolates a device the moment it looks compromised.
- Email security. Filtering for phishing and impersonation, plus SPF, DKIM and DMARC on your domain so nobody can send email as you.
- Multi-factor sign-in. On email, remote access and every admin account.
- Backups attackers can't erase. Copies kept where ransomware can't reach them, and restores tested.
- Patching. Updates applied on a schedule, with the urgent ones pushed first.
- Quarterly retests. We test again every quarter and report what's fixed, what's open and what needs your call.
The difference
A vulnerability scan isn't a pentest
A vulnerability scan is an automated tool that lists known weaknesses. It's useful, but it can't tell you which of them chain together into a real break-in, and it misses problems no scanner knows to look for.
A penetration test is a person doing what an attacker would: trying weak and reused passwords, abusing settings that shouldn't be on, and moving from one system to the next. That's why the results look different, and why SOC 2 auditors and big customers' security reviews so often ask for one.
Oregon
What Oregon expects from you
Every business
Reasonable safeguards and a 45-day breach notice
The Oregon Consumer Information Protection Act requires reasonable security for personal information you hold about Oregonians, and notice to affected people within 45 days of finding a breach.
Cyber insurance
The questionnaire is getting harder
Insurers ask about multi-factor sign-in, backups and endpoint protection before they'll quote. We go through the questionnaire with you and fix the gaps before renewal.
General information, not legal advice.
FAQ
Questions we get asked
Don't see yours? Email hello@portlandsecureit.com and you'll get a straight answer.
How much does a penetration test cost in Portland?
It depends on scope: how many internet-facing systems, apps and locations you have. The Security Baseline is a fixed price for an external test plus a Microsoft 365 or Google Workspace review, quoted after a short call.
How often should we get a pentest?
At least once a year, and after big changes like a new office, a new app or a move to the cloud. Our managed clients get a retest every quarter to confirm the fixes held.
Will a pentest disrupt our business?
We plan it so it doesn't. We agree on scope and timing first, skip anything that could take a system down, and call out anything critical the moment we find it.
We already have an IT company. Can we still work with you?
Yes. We can test your environment and hand the findings to your IT provider, then retest once they've fixed things. Or we can run your security alongside them.
Keep reading