Skip to content

Find the right penetration test and request a quote

Answer a few questions and we'll recommend where to start, which is sometimes a gap assessment rather than a penetration test. Then tell us how to reach you and we'll confirm the scope and send a quote. Prefer to talk it through? Choose the call option below and book a time with us. Every penetration test now includes one year of OrbitalCyber Starter, so you can retest and track fixes after we leave.

Getting started

Answer a few questions so we can check whether a penetration test is the right first step, or skip ahead and book a call.

How would you like to start? (required)

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

Do you follow a cybersecurity framework today? (required)

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

How confident are you in your current security controls? (required)
What you want to learn

Choose what matters most and what you would like in scope.

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

What do you most want to learn? (required)

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

What would you like in scope? (required)

Choose all that apply.

Scope details

We quote penetration tests on the number of servers, workstations, OT systems, cloud environments and sites in scope, and on the size of any application. Approximate numbers are fine.

Answer only if you chose “External network (internet-facing systems)” or “Internal network” or “Operational technology or industrial control systems” for “What would you like in scope?”.

Physical and virtual servers, on-premises or in the cloud. Enter 0 if none.

Answer only if you chose “External network (internet-facing systems)” or “Internal network” or “Operational technology or industrial control systems” for “What would you like in scope?”.

Desktops and laptops. Enter 0 if none.

Answer only if you chose “Operational technology or industrial control systems” for “What would you like in scope?”.

Controllers, HMIs, engineering workstations and other operational technology devices. An approximate number is fine.

Answer only if you chose “Cloud: Microsoft 365, Azure, AWS or Google Cloud” for “What would you like in scope?”.

Count each one separately: for example, each Microsoft 365 or Azure tenant, AWS account or Google Cloud organization.

Answer only if your answer to “How many cloud environments are in scope?” is more than 0.

Which cloud platforms are they on?

Answer only if you chose “Social engineering: phishing and vishing” for “What would you like in scope?”.

Which social engineering techniques would you like included? (required)

Choose all that apply. Phishing campaigns typically need to run for one to two months, so our team can make a sufficient number of attempts.

Answer only if you chose “Physical security: entry, access control and on-site testing” for “What would you like in scope?”.

Buildings or locations we would test.

Answer only if you chose “Physical security: entry, access control and on-site testing” for “What would you like in scope?”.

City and province or country for each site, so we can plan travel.

Answer only if you chose “Physical security: entry, access control and on-site testing” for “What would you like in scope?”.

What kind of physical test would you like? (required)

Answer only if you chose “Physical security: entry, access control and on-site testing” for “What would you like in scope?”.

Should testing outside business hours be in scope? (required)

Answer only if you chose “Web application or API” for “What would you like in scope?”.

For example: Ruby on Rails with nginx on Ubuntu, or a React front end with a .NET API.

Answer only if you chose “Web application or API” for “What would you like in scope?”.

What kind of application testing would you like? (required)

Choose all that apply.

Answer only if you chose “Web application or API” for “What would you like in scope?”.

Would you like an AI-assisted security analysis of your code? (required)

Answer only if you chose “Static code analysis (SAST): we review the source code for security flaws” for “What kind of application testing would you like?”, or you chose “Yes” for “Would you like an AI-assisted security analysis of your code?”.

A rough estimate is fine.

About you

Who we'll be working with.

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

For example PCI DSS, SOC 2, cyber insurance or a customer contract.

Answer only if you chose “Answer a few questions for a recommendation and quote” for “How would you like to start?”.

Testing windows, systems that must not be touched, previous test results, or anything else that helps us scope the work.

Answer only if you chose “Skip the questions and book a 45-minute call with us” for “How would you like to start?”.

Choose a time for your call (required)

Times are shown in your time zone. We'll send a Microsoft Teams invitation to your email.

Friday, November 13
Monday, November 16
Tuesday, November 17
Wednesday, November 18
Thursday, November 19
Friday, November 20
Monday, November 23
Tuesday, November 24
Wednesday, November 25
Thursday, November 26
Friday, November 27
Monday, November 30
Tuesday, December 1
Wednesday, December 2
Thursday, December 3
Friday, December 4
Monday, December 7
Tuesday, December 8
Wednesday, December 9
Thursday, December 10

Times are in America/Edmonton (MST).