Penetration Test - Network and Web Apps

Proposal for annual Pen Testing: Environment A Network Penetration Testing (External + Internal) Up to 150 total external IP addresses; approximately 20 are currently live/internet-facing Up to 1,000 live internal IP addresses (organization-wide estimate: ~175–200 servers, ~50 workstations, ~1,000 Active Directory accounts) Covers the client's main corporate domain and the DMZ Social engineering (phishing) in scope as a breach tactic One on-site testing box for internal testing Note: a secondary internal development domain is confirmed out of scope — no testing requirements there Web Application Assessment 1 primary in-house-developed IIS web application (C#, .NET, Java) Testing will be performed against a non-production/staging instance (app + database) provided by the client — cannot be tested directly from the internet 2–3 pages with user input 2–3 user roles (standard user, supervisor/manager, admin) Up to 10 APIs Authenticates via Duo (SSO); no thick client or client-side technologies (ActiveX, Java applets) in scope Environment B Network Penetration Testing (External + Internal) — no web application component 50 live external IP addresses 500 live internal IP addresses Social engineering in scope as a breach tactic One on-site testing box for internal testing More sizing to be share separately, including IP Addresses, etc. Could be a 1 or 2x engagement.