Written By: Frank Saulsbery
THE LATEST THOUGHTS FROM THE FOUNDER
A running column from Frank Saulsbery. Not a sales pitch, just the way he’d explain it if you pulled up a stool next to him. Meet Frank →
A SNEAK PEEK…
“Even well-protected systems have gaps. The difference is whether you discover those gaps yourself or someone else does.”
You’ve invested in firewalls, antivirus, maybe even backups. Everything looks fine on the surface. Then you hear about another business getting hacked and you wonder, “How would I even know if we have a weak spot?” That’s when someone brings up something called a penetration test, and your first reaction is usually, “Do I really need that?”
It’s a fair question, because from the outside, it can sound a little extreme. Like you’re hiring someone to break into your own business. And in a way, that’s exactly what it is.
A penetration test, or “pen test,” is simply a controlled, authorized attempt to find the weaknesses in your systems before someone with bad intentions does. It’s often described as hiring a “friendly hacker.” Their job is to simulate what a real attacker might do and see how far they can get. Now, I’ll be honest with you, every business that stores important information, whether that’s customer data, employee records, or financial details, has some level of risk. That’s just the reality of working in today’s world.
Even well-protected systems have gaps. The difference is whether you discover those gaps yourself or someone else does. That’s what a pen test helps answer, instead of guessing whether you’re secure, it shows you where things might break. Not in theory, but in real-world terms. Could someone get in? What would they find? How serious would it be? That’s a very different level of insight.
So what actually happens during one of these tests? Without getting too technical, the process usually starts with looking at your systems the way an outsider would. Testers scan for things like open doors into your network, outdated software, or weak security settings. From there, they try to use those openings, sometimes that means testing passwords, sometimes it means looking at email systems and sometimes it’s seeing if they can connect small issues together into a bigger problem.
That last part is important, most breaches don’t happen because of one big failure. They happen because a few small things line up just right. A pen test helps uncover those combinations before they become a real problem.
Now let’s talk about timing, because this is where people get mixed messages. Some industries are required to run these tests regularly, sometimes even quarterly. For most small to mid-sized businesses, a good rule of thumb is at least once a year. If you are making frequent changes to your systems, adding new software, or handling sensitive data, doing it more often can make sense. And if you’ve just made a major change or had a security concern, that’s a good time to test as well.
As for cost, this is where there’s a wide range. There are simpler, mostly automated tests that can give you a basic picture at a lower cost, those can be a good starting point. Then there are deeper, more hands-on tests that take time and expertise, and those can get more expensive depending on how complex your environment is. Neither is “right” or “wrong.” It really depends on your level of risk and what you’re trying to protect. And here’s an honest perspective that doesn’t get said enough, not every business needs the most advanced, expensive test right away.
If you’re a smaller company with a simple setup, starting with a basic test can be perfectly reasonable. What matters more is that you’re taking a proactive approach instead of assuming everything is fine, security isn’t about perfection it’s about awareness. At the end of the day, a penetration test isn’t really about hacking, it’s about getting a clear, honest answer to one simple question.
If someone tried to get into my business today, what would actually happen? If you don’t feel confident in that answer, it might be worth exploring, not as a reaction to fear, but as a way to sleep a little better knowing you’ve looked under the hood. And if nothing serious is found, that’s actually a win. You’ve just confirmed that what you’re doing is working.
My recommendation Is find a trusted partner or advisor and follow their recommendations if you do not fall under compliance guidelines. I look at it as a type of insurance cost, knowing we are covered as best as possible and being sure that we aren't making it easy on a would-be hacker.
That’s how I see it, anyway, and I’d enjoy hearing how you see it. None of this is a sales pitch. It’s just the kind of thing I’d talk through with you if we were sitting across the table. If it raised a question, or you think I have it wrong, I want to hear about it.
My door is always open. Whether you want to talk this through or just say hello, you can reach me anytime.
Network Solutions Unlimited is a generational managed IT services provider based in Decatur, Illinois, serving businesses and nonprofits with genuine support and decades of trusted relationships. Led by Baily Saulsbery and founded by her father Frank, we're not just your IT provider; we're your neighbors who happen to be really good at technology. Contact us today to experience IT support that actually cares.
