Marlton, NJ · Penetration Testing & Incident Readiness Mon–Fri 9:30am–4pm · evenings by appointment
Marlton, New Jersey
Penetration testing for small business · Marlton, NJ

Foresight.

She saw Troy fall and nobody listened. You’re going to listen. We break into your business before someone else does, then hand you a ranked fix list you can start on Monday. Fixed scope. Fixed price. You pay after the report lands.

38

Hours. The longest you wait to hear about a critical finding. We call you; you never have to chase us.

Book Your Scoping Call See The Prices
Hours
Mon–Fri 9:30am–4pm
Evenings by appointment
Find us
3 Light Horse Court
Marlton, NJ 08053
Feature · The Cassandra Problem

Stand Where The Attacker Stands

Isometric 3D illustration of a small office with a glass front door, a back door left ajar, and a golden padlock floating overhead
Fig. 1

A fifteen-desk office, mapped the way an attacker reads it: every front door, every side gate, and the one you forgot was open.

In the myth, Cassandra saw the fall of Troy coming and no one acted on it. We took the name as a job description with one rewrite: when we warn you, you can do something about it by the end of the week. Every finding comes with proof, a plain-English reason it matters, and the smallest fix that shuts the door.

Most small businesses never get tested until something breaks. You don’t have to be one of them. A Cassandra engagement opens with a scoping call and closes with a prioritized remediation report, a debrief, and a retest of what you fixed. From our office on Light Horse Court in Marlton, NJ, we work on site when it helps and remotely when it doesn’t.

You bring the business. We bring a tester who sticks with your scope from kickoff to debrief, a written rules-of-engagement letter, and a habit of calling you before we email you. Then you get to do the fun part: closing doors you didn’t know were open.

A warning only counts if somebody acts on it.The house rule at Cassandra Security
Our Approach · How An Engagement Runs

Locked Scope, Ranked Findings, A Rehearsed Bad Day

01 · Scope

Scope Locked, Price Locked

Every test starts from a one-page scope letter: which systems, which dates, which techniques, and what’s off-limits. The price is on page one. If the work takes us longer than we planned, that’s our hour, not your bill.

  • Written rules of engagement before a single packet moves
  • One quote, one invoice, sent after delivery
SAMPLE REPORT EXCERPT Exposed admin panel Reused password on VPN No MFA on shared mailbox Outdated printer firmware CRITICAL HIGH MED LOW
02 · Report

Ranked By What Hurts First

Your report isn’t a 90-page wall of scanner output. It’s a short, prioritized list: the finding, the proof, how an attacker would use it, and the smallest fix. Hand it to your IT person, your MSP, or whoever “does the computers” and they can start today.

  • Critical findings phoned to you within 48 hours
  • A live debrief, then a retest of what you fixed within 30 days
02:0702:1502:40 DAY 2 Alert firesWho calls whomPull the plugRestore DetectCall treeContainRecover
03 · Rehearsal

Then We Rehearse The Bad Day

A test shows you the cracks. A rehearsal shows you whether your team moves when the crack gives way. We read your incident plan like a stranger at 2am would, then run your leadership through an invented bad day: who calls whom, where the backups really live, who’s allowed to say “unplug it.”

  • Plan review in your own words, not a template’s
  • Three-hour tabletop with the people who’d actually answer
Packages & Prices · Plan A, Plan B, Or Both

Attack It. Then Rehearse It.

Pick the side you’re most nervous about. Every price below is a fixed scope with a written letter, and your invoice arrives after the report does.

Plan A · Offense

Break In, Politely

We act like the attacker so the real one finds nothing left to take.

External Network Test

From$3,850

Every internet-facing door, probed over five business days. Up to 25 live IP addresses.

Book This Test

Web App & Portal Test

From$5,420

Logins, uploads, customer portals, and the booking form you built in 2019. One application, fully mapped.

Scope My App

Phishing-Resilience Assessment

$2,175

A staged phishing campaign across up to 40 inboxes, plus a one-page coaching sheet your team will actually read.

Test My Team
Plan B · Defense

Get Ready For The Bad Day

We pressure-test the people and paperwork that matter once something goes wrong.

Incident Playbook Review

$2,960

We read your response plan end to end, mark every gap, and return a rewritten one-page call sheet.

Review My Plan

Tabletop Rehearsal

$1,840

Three hours, your leadership team, one invented bad day. You leave with a list of decisions to make before it’s real.

Schedule The Drill

Backup & Recovery Check

$2,390

We confirm your backups restore, who can reach them, and how long “back to normal” takes.

Check My Backups
Both Sides · One Invoice

The Full Circuit

External network test, phishing assessment, playbook review and tabletop rehearsal. One scope letter, one debrief, one retest.

$8,640 Run The Full Circuit

Billed by invoice once you’re holding the prioritized remediation report. Pay by ACH, check, or card. Larger networks or multiple sites: ask for a written quote on the scoping call.

The Route · Handshake To Final Fix

Eight Stops Between “Hello” And “Fixed”

01

Scoping Call

Twenty minutes on what you run, what you fear, and what’s off-limits.

02

Rules Of Engagement

A signed letter naming systems, dates, and techniques. No letter, no testing.

03

Recon

We learn your business the way a patient stranger would, from the outside.

04

Active Testing

The agreed window opens. We probe, pivot, and document every foothold.

05

The 48-Hour Call

Anything critical gets a phone call to your named contact, fast.

06

Prioritized Report

Findings ranked by what hurts first, each with proof and the smallest fix.

07

Debrief

A live walkthrough with you and whoever fixes things on your side.

08

Invoice & Retest

You’re invoiced on delivery. We retest your fixes within 30 days.

Book A Call · Mon–Fri, Evenings By Appointment

Twenty Minutes To Your Scope.

Hours
Mon–Fri 9:30am–4pm · evenings by appointment
Office
3 Light Horse Court, Marlton, NJ 08053
Plot Your Route To Light Horse Court →

Tell Us What You Want Tested

Two lines is plenty. We’ll reply by the next business day with a time for your scoping call.

Before Day One · What To Bring

Your Kickoff Checklist

Five small jobs and you’re ready for us to start. Most clients finish the list in an afternoon, and we’ll help with any you’re stuck on.

Start Your List With Us

  1. Sign The Scope Letter

    One page: what we may touch, when, and what’s off-limits. Nothing gets probed without your signature.

  2. Name Your 2am Contact

    One person who picks up if we find something critical, plus a backup for when they’re on a beach.

  3. Send Your Asset List

    Domains, IP ranges, apps, and the cloud accounts you actually use. Can’t list them all? That’s finding number one, and we’ll build the list together.

  4. Warn Your Host Or MSP

    If someone else runs your hosting or IT, we’ll draft the heads-up so they don’t mistake us for the real thing.

  5. Confirm A Fresh Backup

    We test carefully, but you should still be covered. Check that a recent backup exists and restores.

Straight Answers · Before You Sign

Questions Worth Asking First

Will testing knock my systems offline?

Not by design. Our default is non-destructive testing inside the windows you approve in the scope letter. Anything riskier, like stress or denial-of-service work, happens only with your written yes, and we tell you before we start.

Is a test worth it for a team our size?

Attackers automate, so small doesn’t mean hidden. That’s why our entry point is a $2,175 phishing assessment, scoped to a handful of inboxes. You can start small and add the rest later.

Do I get a pass or fail?

No. You get a ranked list of what an attacker could reach, how, and the smallest fix for each item, then a debrief to walk through it with whoever does your IT.

When do I pay?

After delivery. We invoice once you’re holding the prioritized remediation report. Pay by ACH, check, or card.

What if we fix things and want proof?

A retest of your fixed findings within 30 days of the report is part of every engagement, and you get a short written confirmation of what’s closed.

Call Now Scope My Test