Security testing · Southwest Florida
Vulnerability Assessment and Penetration Testing: We Plan the Break-In First
Better a friendly burglar with a clipboard than the other kind.
NerdSquad Managed IT Services finds the weak spots in your network, website and staff habits before attackers do. You get a plain-English report that ranks every finding and shows how to fix it, plus a team that can actually do the fixing.
Scans
Known weaknesses, found
Tests
Real attack paths, tried
Report
Ranked by severity
Fixes
Done by your IT team
01 · Plain English
Vulnerability assessment vs. penetration testing
A vulnerability assessment scans your computers, servers, network and website for known weaknesses: missing patches, outdated software, risky settings and exposed services. It tells you where the doors are unlocked.
A penetration test goes further. Authorized testers try to get in the way a real attacker would, chaining small weaknesses together to see how far they can go. It tells you which unlocked doors actually lead somewhere that matters.
We’re a Managed Service Provider (MSP) in Naples. We run vulnerability assessments ourselves and perform penetration tests with our penetration-testing partner, then help you fix what we find.
What’s included
🎯
Scoping with you
We agree on what gets tested, when, and what’s off-limits before anything starts, in writing.
🔍
Vulnerability scanning
Automated scans of your devices, network and internet-facing systems for known weaknesses.
🧗
Hands-on testing
People, not just tools, trying realistic attack paths against the systems in scope.
📋
Ranked findings
Every issue rated by severity, with evidence, so you know what to fix first.
🛠️
Remediation help
Step-by-step fixes your team can follow, or we handle them as your IT provider.
📈
Progress over time
Each report compares results to your previous test, so you can see what improved.
02 · The blueprint
How a break-in really happens
Attackers rarely need one big hole. They string together small ones. A penetration test draws that path on your building’s blueprint, so you can see each step and the fix that would have stopped it.
Attack path · Sheet 1 of 1
Scale: one small business
A
Front door
Remote access portal open to the internet, no MFA
MFA on every remote login
B
Borrowed key
Staff password reused from a breached shopping site
Password manager and breach monitoring
C
Back hallway
File server missing a year of security updates
Patching on a schedule, checked monthly
D
No interior walls
Guest Wi-Fi, cameras and workstations on one flat network
Network segmentation
E
The vault
Client records on a share every account can read
Least-privilege access and EDR alerts
Illustration of a typical attack path. Your test findings will be specific to your environment.
Not sure which of these you have?
A vulnerability assessment is the quickest way to find out. We’ll start there.
03 · Types of testing
Which test answers your question?
Different tests look at different doors. Most small businesses start with an external test and a vulnerability assessment, then add the rest based on risk, rules and what insurers or clients are asking for.
External network test
Looks at everything the internet can see: firewalls, remote access, email and anything else with a public address.
Exposed services and open ports
Weak or missing MFA on remote access
Outdated software on internet-facing systems
Answers: can someone on the internet get in?
04 · What you get
A report you can actually use
A pen test is only worth what you do with the results. Ours are written for two audiences: the owner who needs to know how worried to be, and the person who has to fix things.
01
Scope and rules
We agree on targets, timing, contacts and limits, and you authorize the test in writing.
02
Discovery
Scans and research map what’s exposed and what’s worth testing.
03
Testing
Testers try realistic attack paths within the agreed rules, and stop to call you if they find something urgent.
04
Report
An executive summary, findings ranked by severity with evidence, and clear remediation steps.
05
Walkthrough
We go through the results with you and agree on what to fix first.
06
Fix and compare
We help close the gaps, and your next test shows what changed since the last one.
A penetration test is evidence for your compliance program, insurer or client questionnaire. It doesn’t make you compliant on its own, and we don’t certify compliance.
Need evidence for an insurer, auditor or client?
Tell us what they asked for. We’ll make sure the test and the report answer it.
05 · Which plan includes this?
Testing is added to any plan
Vulnerability assessments and penetration tests are added to any managed IT plan and scoped to your environment. The day-to-day protection they test is already in every plan.
What you get
Endpoint Starter
Endpoint Pro
Endpoint 360
Monitoring, patching and EDR on every device
✓ Included
✓ Included
✓ Included
MFA enforcement and sign-in monitoring
✓ Included
✓ Included
✓ Included
24/7 SOC monitoring and MDR
—
—
✓ Included
Compliance support and reporting
—
—
✓ Included
Vulnerability assessment and penetration testing
Add-on
Add-on
Add-on
Security awareness training
Add-on
Add-on
Add-on
Your written proposal lists exactly what’s covered.
Compare the three plans →06 · Questions owners ask us
Penetration testing FAQ
What’s the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment uses scanning to find known weaknesses. A penetration test has people try to exploit those weaknesses the way an attacker would, to show which ones actually lead to your data. Assessments are broader and more frequent; pen tests go deeper.
Does a small business really need a penetration test?
Often, yes. Insurers, auditors and larger clients increasingly ask for one, and small businesses are common targets because they’re easier to get into. If no one is asking yet, a vulnerability assessment is a sensible first step.
How often should we test?
At least once a year and after major changes, like a new office, a new system or a move to the cloud. Some rules set their own schedule. The FTC Safeguards Rule, for example, calls for annual penetration testing and vulnerability assessments every six months for covered financial businesses unless they use continuous monitoring.
Will testing disrupt our business?
Testing is scoped and scheduled with you in advance, and sensitive systems can be tested after hours or excluded. Testers stop and call you if they find something urgent or see a risk of disruption.
Who performs the test?
We run vulnerability assessments ourselves and perform penetration tests with our penetration-testing partner. We handle scoping, coordination and the follow-up fixes, so you have one point of contact.
What will the report include?
An executive summary in plain English, each finding ranked by severity with evidence, clear remediation steps and, for repeat tests, a comparison to your previous results.
Is a penetration test legal?
Yes, when it’s authorized. Every test starts with a written agreement that defines what can be tested, when and how. Testing anything outside that scope is off-limits.
Can you fix what the test finds?
Yes. As your IT provider, we can patch systems, change settings, add MFA, segment your network and tighten access, then confirm the fixes in your next test.
Will a pen test make us compliant?
No test makes you compliant on its own. It’s evidence that you’re checking your defenses, which frameworks like PCI DSS, SOC 2 and HIPAA risk analysis expect. Your auditor or compliance officer makes the call.
Is penetration testing included in your managed IT plans?
Vulnerability assessments and penetration tests are added to any plan and scoped to your environment. The monitoring, patching, EDR and MFA they test are part of every plan.
By industry
Financial firms, medical practices and anyone who handles card payments get asked for testing first.
Near you
We’re based in Naples. Cybersecurity pages by city:
Security testing
Find the gaps before someone else does
Tell us what you want tested and who’s asking for it. We’ll recommend the right mix of assessment and testing and send a written scope.
Which test answers your question
What’s in and out of scope
A timeline that works around your business
NerdSquad Managed IT Services · Naples, FL · 239-465-0079
Request a testing scope
A real person reads every message. Please don’t send passwords or sensitive data.
