Penetration testing and security reviews sized for small and mid-sized businesses.

Fixed-price security testing and configuration reviews for Michigan and remote U.S. small and mid-sized businesses (roughly 10–500 employees): CPA and tax firms, insurance agencies, mortgage and lending offices, professional-services firms, and the MSPs that support them. Plain-English reports you can hand to your insurer, auditor, or customers.

Request a scoping call See packages & pricing

Fixed prices published up front

Manual testing, not a resold scan

Retest included on every package

Attestation letter for insurers & auditors

Three ways to start

Each package has a defined scope, a fixed price, and a clear deliverable.

Package 1

External Attack Surface Check

from $1,750

About 1 week

What can an attacker, or your cyber insurer's scanner, see and exploit on the internet right now?

Good first step before a cyber-insurance renewal.

Package 2

Microsoft 365 / Google Workspace Security Review

from $2,250

1–2 weeks

A read-only configuration review of the system that holds your email, files, and logins, mapped to CIS controls.

Any organization on M365 or Workspace, from 5 to 500 users.

Package 3

SMB Pentest

from $6,500

2–3 weeks + 45-day retest window

If a real attacker targeted you, how far could they get, and what should you fix first?

Supports the FTC Safeguards Rule annual penetration-testing requirement. Larger scopes quoted to fit.

Full scope, deliverables, and pricing →

How an engagement works

No surprises: scope and rules are agreed in writing before any testing begins.

Scoping call

We confirm goals, assets in scope, and the right package.

SOW & rules of engagement

Signed scope, testing windows, contacts, and written authorization.

Testing

Manual, non-destructive testing aligned to NIST SP 800-115 and OWASP WSTG.

Report & readout

Executive summary, evidence, plain-English fix steps, and a live walkthrough.

Retest

We verify your fixes and issue a retest or attestation letter.

Why Northline

Enterprise-grade testing, SMB pricing. Led by an offensive security engineer with enterprise penetration testing and financial-sector assessment experience.
Reports people can act on. Every finding comes with evidence, a severity rating, and specific fix steps your IT provider can follow.
MSP-friendly. Your IT provider is welcome on the readout call, and white-label arrangements are available.
Safe by design. Testing stops at proof of impact. Nothing destructive, nothing outside the signed scope.

Not sure which package fits?

Tell us about your business and what is driving the question (insurance renewal, a customer questionnaire, FTC Safeguards, or just peace of mind). You will get a straight answer and a fixed quote.

Request a scoping call