RJ2 Technologies is a managed IT and cybersecurity provider headquartered in Deer Park, Illinois, and we have worked with small and mid-sized businesses across the Chicago area since 1998. A penetration test is an authorized, scheduled attempt to break into your systems the way an actual attacker would, so you find out what is exploitable before someone else does. We scope the test, coordinate the engagement and work through the findings with you, and then fix what it found, which is the part most companies skip.
What is a penetration test?
A penetration test is a controlled, authorized attack on your own network, applications and accounts, performed on a schedule you agree to in advance, to prove which weaknesses can actually be used against you. It is done by people, not only by software, and the point is not a list of theoretical problems but a demonstration of what an attacker could really reach and how far they could get.
The test has a written scope, a start date and an end date, and rules of engagement that say what is in bounds and what is off limits. Everything is logged. Nothing is done to your environment that you have not approved in writing first. When it is over you get a report that shows the path taken, the evidence, and what to fix in what order.
How is a penetration test different from a vulnerability scan?
A vulnerability scan is automated software that inventories known weaknesses and hands you a list. A penetration test is a person taking that list, plus everything the scanner cannot see, and proving which items actually chain together into a break-in. The scan tells you a door is unlocked. The test walks through it and tells you what was in the room.
The practical difference is false positives and priority. A scan will happily report two hundred findings with no sense of which one matters on your network. A test tells you that three of those two hundred can be chained into domain administrator access on a Tuesday afternoon, and that the other one hundred ninety-seven can wait. Most small businesses need scanning continuously and testing periodically. They are not substitutes for each other, and an insurer or auditor who asks for a penetration test will not accept a scan report in its place.
What happens during a penetration test, and in what order?
An engagement runs in six steps, in this order: scoping, reconnaissance, testing, exploitation, reporting, and retest. Nothing starts until the scope and the written authorization are signed.
- Scoping. We agree what is being tested (external network, internal network, wireless, web application, Microsoft 365 and cloud identity, or some combination), what is explicitly out of bounds, when testing may run, and who gets called if something goes wrong. This is also where you decide how much the testers are told up front.
- Reconnaissance. Public information about your company is collected the way an attacker would collect it: exposed services, email address patterns, credentials from past third-party breaches, anything on the open internet that gives someone a starting point.
- Testing. Systems in scope are probed for weaknesses. This is where automated tooling is used, but it is supervised, and results are verified by hand instead of being dumped into a report.
- Exploitation. Confirmed weaknesses are actually used, carefully and within scope, to establish how far an attacker gets. This is the step that separates a test from a scan. It is done during an agreed window with a live contact on your side.
- Reporting. Findings are written up with evidence, severity, and specific remediation steps.
- Retest. After you fix the important findings, the same items are tested again to confirm they are actually closed. A test with no retest is half a test.
Throughout, RJ2 is your point of contact. You are not managing the engagement yourself, and you are not left to interpret the findings on your own.
What does the deliverable look like?
You get a written report plus a working session to go through it. The report has three layers: an executive summary a non-technical owner or board member can read, a prioritized findings list with severity ratings, and the technical detail with evidence for whoever has to do the fixing.
Each finding states what was found, how it was exploited, what the business impact is, and what to do about it. The prioritized list is the part that matters most, because it is what turns a scary document into a work plan. RJ2 takes that list and builds the remediation into your regular IT work rather than handing you a PDF and walking away.
How often should a small business run a penetration test?
Once a year is the working baseline for most small businesses, plus a test after any significant change to your environment. Significant means a new office or location, a move to or from a cloud platform, a major application rollout, a merger or acquisition, or a change to how remote staff connect. RJ2 can run testing on a weekly, monthly, quarterly, semi-annual or yearly schedule, depending on your requirements.
Some companies test more often because someone requires it. If you take card payments, handle protected health information, sell into enterprise customers, or carry a cyber insurance policy above a certain limit, your frequency may be set by that requirement rather than by your own judgment. Annual testing with continuous vulnerability scanning in between is the pattern that fits most businesses in the twenty to two hundred employee range.
How does penetration testing relate to cyber insurance and SOC 2?
Both increasingly ask for it in writing. Cyber insurance renewal questionnaires now routinely ask whether you perform penetration testing and how often, and answering no, or answering yes when you only run scans, is the kind of thing that affects your premium or gets examined closely after a claim. SOC 2 does not name penetration testing as a required control in the standard itself, but auditors commonly expect it as evidence for the risk assessment and monitoring criteria, and most SOC 2 reports in practice include it.
The useful way to think about it: the test is the evidence, not the goal. An insurer wants proof you looked for your own weaknesses on purpose and did something about what you found, and the report plus the retest is that proof. RJ2 gives you the information and suggestions behind the technical answers on your insurance questionnaire, and you complete and sign it. Audit assistance is available through a specialist partner under a separate agreement.
What a penetration test does not cover
A penetration test is a snapshot of a defined scope on a defined date. It is not a guarantee, it is not continuous, and it does not cover anything you left out of scope. Three limits are worth stating plainly.
- It expires. The environment you tested in March is not the environment you have in September. A test proves what was true during the testing window, which is exactly why it is repeated.
- It only covers what was in scope. If wireless, the branch office, the vendor-managed application or the Microsoft 365 tenant were excluded to control the price, they were not tested, and the report should not be read as though they were.
- It does not fix anything. The test finds and proves. Remediation is separate work, and a report sitting unactioned in a shared drive has bought you nothing. This is the single most common failure we see.
A penetration test is also not a substitute for endpoint detection and response, monitoring, backups, patching or security awareness training. Those are the controls. The test measures whether the controls hold. If you do not have the controls yet, start with Cyber Security Services and Managed Network Infrastructure first, then test.
Penetration testing for Chicago and the Chicago suburbs
RJ2 Technologies is headquartered in Deer Park, Illinois, and works with businesses across Chicagoland, Rockford and Northern Illinois, southeastern Wisconsin and northwestern Indiana, and nationwide for larger clients with multiple locations. We have been doing this from the same corner of the Chicago area since 1998.
We also keep a working space downtown at 333 S. Wabash Ave., Suite 2700, which our engineers use when they are in the city for a client. It is not a staffed office, and we do not pretend otherwise. Testing is coordinated remotely in most cases, and on site when the scope requires it, which is normal for internal network, wireless and physical access work.
How to start
Book a discovery call, or call the office. The first conversation is about scope: what you have, what you are being asked for by an insurer, customer or auditor, and what testing would actually be useful rather than expensive. We will not quote a price before we understand the scope, and we will tell you if what you need is scanning and remediation rather than a full test.
Corporate: 847-303-1194 · Support: 847-303-1193 · Email: sales@rj2t.com
