Penetration Testing · Brooklyn, NY
Harbor Lantern is the Brooklyn, NY practice that gets there first. We run penetration tests, phishing simulations, and SOC 2 readiness assessments for mid-sized SaaS companies, and close every engagement with a remediation roadmap ordered by what an attacker would reach first.
Engagements & Fees
Harbor Lantern bills per engagement. The figures below are starting fees for a typical mid-sized SaaS environment — 50 to 500 staff, one primary product, one cloud provider. Your scoping call fixes the final number, and it does not move once testing begins.
Engagement · 6–8 testing days
Authenticated, manual testing of your product the way a paying customer — or a former one — would approach it.
House Rule
Findings are ranked by how far an attacker gets from them — not by a scanner’s severity score alone.
Engagement · 4–5 testing days
Every internet-facing host, VPN, and forgotten subdomain, tested from outside your walls under PTES methodology.
Assessment · 4 weeks
A control-by-control reading of where you stand before an auditor arrives. We prepare you for the audit; a licensed CPA firm conducts it.
Campaign · Up to 400 staff
Pretexts written from your own vendor list and org chart, not a template library. Results reported by department: clicked, submitted credentials, reported.
Quarterly program, four campaigns: $13,800 a year.
Engagement · 3–4 review days
AWS, GCP, or Azure — IAM privilege paths, public storage, logging gaps, and the role nobody remembers creating. Up to three accounts.
Verification only
Holding another firm’s report? We verify each fix against the original reproduction steps and issue a closure letter.
Program · 12 months
One web and API test, two phishing campaigns, and a readiness check-in sixty days before your audit window. Invoiced quarterly.
Bespoke scope
iOS and Android clients, on-premise appliances, or a multi-week objective-based exercise. Quoted after a scoping call.
The Debrief
Each engagement closes with a ninety-minute debrief with your engineering leads. We walk the findings in the order they should be fixed, answer questions about reproduction, and leave with an owner named against every line.
Read aloud at every debrief
“Finding seven is not the most severe in this report. It is the most reachable. It goes first.”
The sentence every Harbor Lantern roadmap is written to justify.
Reproduction steps your engineers can repeat without us on the line.
An executive summary written for directors, not for a SOC analyst.
Findings tied to Trust Services Criteria wherever they apply.
Method
We establish what is in scope, what is fragile, and who answers the phone if something breaks. A fixed-fee proposal follows within two business days.
40 minutesTesting windows, source IPs, rate limits, out-of-bounds systems, and a stop word. Nothing is touched until the document is countersigned.
Signed before day oneSubdomains, exposed buckets, credentials leaked to public repositories, and the staff directory a phishing pretext would draw on.
1–2 daysManual testing led by the methodology the engagement calls for — WSTG for web, PTES for network — with automated tooling in support, never in charge.
4–8 daysA confirmed critical finding is phoned to your designated contact the business day it is confirmed, with steps to reproduce. It does not wait for the PDF.
As neededFindings ranked by reachability and impact, each with an owner, an effort estimate, and the control it maps to — then read through with your leads.
10 business daysFixes verified against the original reproduction steps; the report is reissued with every finding marked closed or open.
Within 60 days · includedScroll or swipe the phases →
Who We Serve
Our clients are software companies past their first hundred customers and short of a full-time security team. The call tends to arrive at one of four junctures.
A large buyer has sent three hundred questions, and one of them asks for a penetration test letter dated within the last twelve months. We supply the test, the report, and the attestation letter your sales team can forward.
An auditor has been engaged, or soon will be. You need to know which controls exist only in a policy document, and which can produce evidence on request.
A platform rebuild, a public API launch, or a move to multi-tenant architecture has quietly changed what one customer can see of another.
Everyone has completed the annual training video. No one has yet received a pretext built from your own org chart, your payroll vendor, and last week’s all-hands.
Book a Scoping Call
Calls are held by appointment. The engineer who will lead your engagement is on the line — not a sales representative — and the proposal you receive names that engineer.
As a fixed fee, agreed in writing after the scoping call. Invoicing is 50% at kickoff and 50% on delivery of the report. Any change in scope is priced and countersigned before additional testing begins.
Testing runs inside windows you approve, from published source IPs, under agreed rate limits. Destructive or state-changing tests are performed against staging where one exists, and either party may halt work at any time with the agreed stop word.
No. Harbor Lantern is not a CPA firm and does not issue SOC 2 reports. The readiness assessment prepares you for the auditor: it identifies control gaps, maps the evidence each control requires, and names an owner for each.
We telephone your designated contact the same business day the finding is confirmed, and follow with written reproduction steps. Testing of that path pauses until you confirm how you wish to proceed.
Reports are delivered through an encrypted share, never as plain email attachments. Testing artefacts are retained only until the retest closes, then deleted, and we confirm the deletion in writing.
Invoiced per engagement: half at kickoff, half on report delivery. Settled by ACH, wire, or card.
On Delivery
Before the report
A confirmed critical is phoned in the business day it is found, with reproduction steps in writing behind it.
Business days
10from the close of testing to your written remediation roadmap.
After the report
One verification of fixed findings within sixty days is included in every engagement — no second invoice.