Pen testing · Audits · IR plans — New York, NY
A Few Doors Were Open. We Closed Them.
Halcyon is a small New York, NY security consultancy. We break into your networks, apps and offices on purpose — with permission and a signed scope — then stay on the call with your team until every hole has a fix and a name next to it.
- External networks
- Web apps & APIs
- Cloud IAM on AWS, Azure & GCP
- Office Wi-Fi
- Phishing simulations
- Badge readers & side doors
- SOC 2 readiness
- Tabletop drills
How it goes
From Scoping Call To Retest
Same rhythm whether it’s a 12-IP external test or a full web-app teardown. You always know what we’re touching, when, and who to call if something looks weird.
Why the name? The Greeks called the calm winter stretch when the kingfisher nested on a flat sea the halcyon days. We do the noisy part — the poking, the phishing, the “found something” call — so the rest of your year can look like that.
-
The Scoping Call
Thirty minutes, free, NDA signed first. Tell us what’s exposed and what’s genuinely worrying you — the vendor portal, the office Wi-Fi, the client upload page — and we’ll suggest the smallest scope that answers it.
-
Rules Of Engagement
A two-page letter both sides sign: IP ranges, domains, test accounts, blackout dates, and a name at each end who can call a hard stop. Nothing gets touched before it’s countersigned.
-
The Break-In
Manual-first testing. We map what you’ve got facing the internet, then chain small weaknesses the way a real intruder would. Scanners help us look around; they’re never the deliverable.
-
The Readout
A live call with your engineers and whoever signs the budget. Every finding gets a CVSS severity, a reproduction video, and a fix written for your actual stack — not a link to a generic advisory.
-
The Retest
Patch what you can. Within 60 days we re-run every fixed finding at no added cost and reissue the report — so the version your customers see shows the holes closed, not just found.
-
Bring This To Kickoff
- A current list of domains and public IPs — including the embarrassing ones.
- One test login per user role, admin included.
- Your release calendar and any change-freeze dates.
- A named human who picks up the phone during testing windows.
Fair questions
Things People Ask Before They Let Us In
-
Will You Take Down Production?
Not on our watch. The rules of engagement spell out what’s in scope, what’s off-limits, and when we’re allowed to test. Denial-of-service stays out unless you specifically ask for it, and either side can call a stop at any moment.
-
Is A Pen Test Overkill For A 30-Person Company?
If you hold client data, take payments, or a customer is asking for a SOC 2 report, probably not. If you’re earlier than that, a $4,850 audit is usually the smarter first spend — and we’ll say so on the call, even though it’s the smaller invoice.
-
How Long Until We See A Report?
Testing usually runs 5–10 business days depending on scope. The written report lands within 7 business days after testing wraps. Critical findings don’t wait for it — you get a phone call within 4 hours of us confirming one.
-
What’s Actually In The Report?
A one-page summary your board can read over coffee, then every finding with severity, reproduction steps, screenshots or video, and a fix in your stack’s language. Plus an attestation letter you can hand straight to customers.
-
What If You Don’t Find Anything?
Then you get a report that documents everything we tried, which auditors and customers love. We’ll also be straight with you about whether a different scope would be a better use of next year’s budget.
The work
Three Things. We Don’t Dabble.
We run penetration tests against your networks, web apps and APIs. We run security audits that line your controls up against SOC 2, ISO 27001, or whatever your biggest customer’s 200-row spreadsheet is asking. And we write incident-response plans — then rehearse them with your team around a table, so the first time you use one isn’t at 3 a.m.
Why now
Attackers Don’t Wait For Your Q3 Roadmap
The Way In Is Usually Boring
A forgotten staging server. A vendor VPN account nobody offboarded. A password reused from an old breach dump. Real intrusions rarely look like the movies — which is exactly why they work.
4hrs
Our ceiling between confirming a critical finding and calling your named contact. The bad ones don’t wait for the PDF.
A Scan Isn’t A Test
Scanners list issues. A tester chains three “medium” findings into one very bad afternoon — then shows you how, so you fix the chain and not just the links.
Price tags
What It Costs, Before You Have To Ask
Honest starting points for a typical 20–150 person company. After the scoping call you get one fixed quote — bigger scope, bigger number, and we’ll show you the math line by line.
Grab the free 30-minute call-
From
$6,400
External Network Pen Test
Up to 64 public IPs, five testing days, report plus 60-day retest.
Scope this one -
From
$9,750
Web App & API Test
One app, two authenticated user roles, findings mapped to the OWASP Top 10.
Scope this one -
From
$4,850
Security Audit
Controls review against SOC 2 or ISO 27001, with a gap list ranked by effort.
Scope this one -
Flat
$3,600
Incident-Response Plan
A written playbook plus a three-hour tabletop drill with your team.
Scope this one
Invoiced in two halves — one when the scope letter is signed, one when the report lands. Card, ACH or wire.
Say hi
Tell Us What’s Keeping You Up
A sentence or two is plenty — “a customer wants a pen test by March,” “we just got phished,” “our IT person left.” A real person replies within one business day.
When We Pick Up
| Mon–Fri | 9:30am–4:30pm |
|---|---|
| Evenings | By appointment |
Testing windows can run overnight if your scope letter says so.