HomeServicesPenetration TestingNew York City

Penetration Testing · New York City

Penetration Testing in New York City

Manhattan packs more regulated firms into a few square miles than most states hold: broker-dealers and investment advisers, insurance brokers licensed by NYDFS, law firms holding escrow and deal documents, and the vendors between them. Each one is asked, by a regulator, an insurer or a client, to prove what an attacker could reach. NetSys answers that question with a free remote external test and, where it is needed, an internal test run on site in the five boroughs.

All IT services in New York City

The short answer

NetSys provides penetration testing to New York City businesses. Tier 1 is a free remote external network test within an authorized scope agreed in writing. Internal network, web application and social engineering tests are scoped separately, and internal testing can run on site in the five boroughs, which is what NYDFS and insurers ask New York firms to show.

Service information by The NetSys Group. Our editorial standards.

How penetration testing is delivered in New York City

The free external test runs remotely from Brooklyn. We agree the public addresses, domains and exposed services in scope, you sign the authorization, and testing happens in a window stated in Eastern time, with a named contact reachable while it runs. The testing itself is AI-driven, and an engineer verifies every finding before it goes into the report, so you receive proven entry points rather than a scanner export. Internal testing is where New York City differs from every other market we serve: because the five boroughs sit inside our on-site radius, an engineer can bring a test device to your office in Manhattan, Brooklyn, Queens, the Bronx or Staten Island and start from the position of a phished laptop or a visitor on the guest Wi-Fi. That work is scoped separately and never assumed. Building management often wants vendor paperwork before anyone works in a tenant space, so we handle that during scoping rather than on the day. Web application testing, the Tier 2 engagement, happens in an isolated NetSys sandbox and never touches your production systems wherever your developers sit.

What 23 NYCRR 500 asks of New York financial firms

The NYDFS cybersecurity regulation applies to banks, insurers, insurance producers, mortgage companies, money transmitters and other entities licensed by the Department of Financial Services, and many of them are headquartered or have their main office in Manhattan. Section 500.5 requires covered entities to conduct penetration testing of their information systems at least annually, from both inside and outside the systems' boundaries, performed by a qualified internal or external party. It also requires automated vulnerability scans at a frequency set by the entity's risk assessment and promptly after any material system change, a manual review of systems the scans cannot reach, and timely remediation ranked by risk. A limited exemption in 500.19 relieves entities with fewer than 20 employees and independent contractors, under $7.5 million in gross annual revenue in each of the last three years, or under $15 million in year-end total assets from section 500.5 and several other sections, though they still file a notice of exemption. The free external test covers the outside half of the 500.5 test; the inside half is a separately scoped internal test. Which obligations apply to your firm is a question for your CISO and counsel, not for a test report (checked on November 7, 2026).

SHIELD Act, insurers and the client security questionnaire

Firms that are not DFS-licensed still have a New York reason to test. The SHIELD Act, General Business Law 899-bb, requires any business holding the private information of a New York resident to maintain reasonable administrative, technical and physical safeguards, and its technical safeguards include regularly testing and monitoring the effectiveness of key controls. A small business, defined as fewer than 50 employees, under $3 million in gross annual revenue in each of the last three fiscal years, or under $5 million in year-end total assets, meets the standard with safeguards appropriate to its size and the sensitivity of the data it holds; the Attorney General enforces the section and there is no private right of action. In practice the stronger pressure comes from two other directions. Cyber insurers ask on the application and at renewal whether the business has had an external test and how the findings were closed. And the enterprise clients that Manhattan law firms, accountants, consultancies and fund administrators serve send security questionnaires that ask the same thing. A dated report with the scope stated and the fixes verified answers both without a scramble (checked on November 7, 2026).

What a Manhattan firm's external attack surface usually looks like

Financial and legal firms in New York share a profile. Most run Microsoft 365 with a sign-in page that anyone on the internet can reach, a remote access path that predates the pandemic (a VPN appliance, a published remote desktop gateway or a Citrix farm), a secure file transfer or client portal from a line-of-business vendor, a document management system, and a trading, custody or practice management platform that connects to counterparties over the internet. Each of those is an exposed service, and each has a history of vulnerabilities that attackers scan for within days of disclosure. The free external test enumerates what is actually reachable at your public addresses, checks it against what the vendors have published and what the test itself can demonstrate, and reports what an attacker could do with it in business terms: try stolen passwords against a login that sits outside multifactor authentication, reach an administrative interface that should never have been public, or read a certificate that names an internal host. The report also says plainly what was not tested, so nobody reads more into it than the scope supports.

Internal testing on site in the five boroughs

An internal test answers a different question from the external one: once an attacker or a careless insider is on the office network, how far can they get? For New York City offices we can run it in person. An engineer connects an agreed test device to the office network, or to the Wi-Fi only when that is in the written scope, and works from that foothold: what the device can see, which servers and shares answer, whether a standard user account can reach administrative systems, how the firm's network segments or fails to segment the printers, cameras and conference rooms from the systems that hold client data, and what a stolen or phished account would open. The scope names the sites, subnets and devices in play and anything out of bounds, such as a fragile trading system, and it sets the dates and the hours. Findings use the same format as the external report, with the paths an insider could take between systems. Firms outside the five boroughs but within about 50 miles of Brooklyn can also add on-site internal work; beyond that, internal testing is arranged remotely from a device you host.

What is included

Penetration Testing in New York City: what NetSys delivers

Tier 1: free external network test

Agreed domains and public-facing systems within the authorized external scope
Public information available to NetSys that is relevant to the agreed scope
Exposure indicators supported by the available information, with limitations stated
A prioritized fix list in plain English, yours to keep
Delivered remotely; internal and onsite reviews are scoped separately

Scoped separately: internal network and social engineering

Internal test from a foothold inside, such as a phished laptop or a contractor's account, with the paths an insider could take between systems
Sites, subnets and devices agreed in writing; Wi-Fi and physical access are added only when agreed
On-site internal work in the five boroughs and within about 50 miles of Brooklyn
Phishing and social engineering measured through simulated phishing in our security awareness training

Tier 2: web application and source code test

Your application and its source code, under NDA, built and run in an isolated NetSys sandbox
Static code review plus dynamic testing of the running app and its APIs
Dependency, secret and configuration scanning
Findings with severity, reproduction steps and the specific fix, then a retest; quoted per codebase

The report

Findings ranked by real-world risk, each with evidence, attacker impact and the fix
What was in scope, the information available and what was not tested, stated plainly
Written so your IT team, your current provider or NetSys can act on it

Illustrative engagement

A 35-person Manhattan insurance brokerage ahead of its April 15 NYDFS filing

This planning example shows how we could scope the work. It is not a claim about a customer in this market or a measured result. For published customer work, see our case studies.

Illustrative planning example, not a client. A commercial insurance brokerage with 35 staff on two floors near Bryant Park is licensed by the Department of Financial Services and sits above the 500.19 exemption thresholds. Its compliance officer has to sign the annual certification by April 15 and cannot find a penetration test newer than the one its former IT provider ran three years ago. The agency management system is hosted by a vendor, email is Microsoft 365, and staff reach the office through a remote desktop gateway nobody remembers setting up.

Free remote external penetration test of the brokerage's public addresses, domains and the remote desktop gateway, within an external scope agreed and authorized in writing
Internal network test on site at the Manhattan office, scoped separately, starting from a standard user's laptop on the staff network and from the guest Wi-Fi
Findings ranked by real-world risk, each with evidence, attacker impact and the specific fix, with the inside and outside tests reported against the two halves of 23 NYCRR 500.5
A retest of the fixes the brokerage's provider applies, agreed in the scope, so each closure is confirmed rather than assumed
A short briefing for the compliance officer and the provider on what the report does and does not demonstrate

The deliverables are two dated reports covering the external and internal tests, a retest record, and a scope statement the compliance officer can file with the certification evidence. Whether the firm has materially complied with Part 500 remains its own determination, made with counsel.

Published case study

Law office: Microsoft 365 with layered security and cloud-to-cloud backup

A 25-attorney firm in the greater New York metro had an aging file server and an email server that needed weekly attention. NetSys mapped the firm's matters and document workflows, moved email to Exchange Online and documents to SharePoint and OneDrive in a matter-based structure, and layered anti-phishing protection, DNS filtering, multifactor authentication and endpoint protection across attorney devices, with independent cloud-to-cloud backup of the tenant. The write-up shows the kind of environment a Manhattan professional firm ends up with, and the exposed services an external test then checks.

Read the full case study (25 attorneys + staff)

New York rules that drive penetration testing

23 NYCRR 500.5 requires DFS-covered entities to run penetration testing at least annually from inside and outside their systems, by a qualified internal or external party, with vulnerability scans at a frequency set by the risk assessment and after material changes; 500.19 exempts small entities from that section when they fall under its employee, revenue and asset thresholds. The SHIELD Act, General Business Law 899-bb, requires every business holding New Yorkers' private information to maintain reasonable safeguards, including regular testing of key controls, with a size-based standard for small businesses. The free external test and a separately scoped internal test produce evidence for both. Which rules apply to your firm, and whether a given test satisfies them, is for your CISO and counsel to determine. Checked on November 7, 2026.

Primary sources

What penetration testing costs in New York City

The Tier 1 external test is free within its agreed scope, with no obligation and no sales pressure; it is the only free offer NetSys makes. The Tier 2 source code and web application test is quoted per codebase after a short technical call, and the repository size, user roles, API endpoints and build complexity move the number. An internal network test is scoped separately, and whether it needs an engineer on site in the five boroughs is one of the things that sets its price. A retest is included for Tier 2 findings once you patch and agreed in the scope for other tests. No rate card is published; every scope is agreed and authorized in writing before testing starts.

How the monthly fee is built

Who this fits, and who it does not

Best fit: a New York City business with 10 to 250 staff that has been asked by a regulator, an insurer or a client to show what an attacker could reach, or that wants to know before someone else finds out, including DFS-licensed firms with an annual 500.5 obligation.

Not a fit: a firm that wants a scanner export relabeled as a penetration test, or a compliance certificate; NetSys produces evidence, and the compliance determination stays with you and your counsel.

Penetration Testing in New York City: FAQs

Do you run penetration tests on site in New York City?

The free external test is remote by nature: it works from the internet, the way an attacker would, and no visit is needed. Internal testing is different, and New York City is the one market where we run it in person. An engineer can bring a test device to an office in any of the five boroughs, or anywhere within about 50 miles of our Brooklyn office, and work from a foothold on your network. That internal work is scoped and priced separately and is never assumed from the free test.

Is the free external penetration test really free for a New York business?

Yes. The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. You sign the authorization, we test within the window, and the findings are yours whether or not you ever hire us. It does not include internal access, a Microsoft 365 tenant review, on-site work or a compliance assessment; those are scoped separately.

Does 23 NYCRR 500 require a penetration test?

For covered entities that are not exempt, yes. Section 500.5 requires penetration testing of information systems at least annually, from both inside and outside the systems' boundaries, by a qualified internal or external party, together with automated vulnerability scans and timely remediation. Entities under the 500.19 thresholds (fewer than 20 employees and contractors, under $7.5 million in gross annual revenue, or under $15 million in year-end total assets) are exempt from that section but still file a notice of exemption. Checked on November 7, 2026; your CISO and counsel decide what applies to your firm.

Does the free external test satisfy the NYDFS requirement on its own?

It covers the outside half: testing from outside the information systems' boundaries, within an agreed scope. Section 500.5 also calls for testing from inside, which is the separately scoped internal test we can run on site in New York City. The report states exactly what was tested and what was not, so your CISO can decide what else the firm's risk assessment requires. A free external report should not be assumed to satisfy a requirement for an internal, authenticated or compliance-specific test.

What does penetration testing cost in New York City?

The external network test is free within its agreed scope. The web application and source code test is quoted per codebase after a short technical call. An internal network test is scoped separately, and an engineer's time on site in the five boroughs is one of the inputs. No rate card is published. When you compare proposals, compare the authorized assets, the access provided, the methodology, the report detail and whether a retest is included, rather than package names.

Does the SHIELD Act require penetration testing?

Not by name. General Business Law 899-bb requires reasonable administrative, technical and physical safeguards for New Yorkers' private information, and the technical safeguards include regularly testing and monitoring the effectiveness of key controls. A penetration test is one recognized way to do that testing, and a dated report is the kind of evidence the Attorney General, an insurer or a client would expect to see. The small-business standard scales the safeguards to the size of the business and the sensitivity of the data; it is not an exemption. Checked on November 7, 2026.

What is in the report, and who sees it?

Each finding states what was found, its severity ranked by real-world risk, the evidence the test observed, what an attacker could do with it in business terms, and the specific fix. The report also records the scope, the information available and what was not tested. It goes to the contacts named in the authorization and nobody else; you decide whether to share it with your IT provider, insurer, auditor or a client. Our penetration testing report template post shows the format.

How long does a penetration test take for a New York City firm?

The external test runs within the window agreed in the authorization, and the report follows once an engineer has verified every finding. An internal test adds the on-site day or days named in the scope plus reporting. Tier 2 timing depends on the codebase and is put in writing before work starts. Fixes are yours to schedule, and the retest happens when you say the fixes are in.

Start with the free test

See what an attacker sees from the internet, then decide about the inside.

The free offer is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Internal testing on site in the five boroughs, web application testing and broader reviews are scoped separately. Our cybersecurity page for New York City covers the managed security that follows.

Explore Penetration Testing Scope 845-203-3914