Penetration test
Penetration testing for small businesses: how it runs, and what drives the price.
A penetration test is an attack you order yourself. A specialist tries to get into your systems, within a scope and on dates fixed by contract, then hands you a report: the flaws found, the proof, the severity and the fix. At Ryze Cyber it runs in five steps and the price is published: EUR 1,490 (or CHF 1,490) excluding tax for the full audit.
How does a penetration test run?
These are the five steps published on the Ryze Cyber website, plus a sixth one to plan for.
- Scoping. Together you define what is tested and what is not: website, client area, accounts, infrastructure, AI tools.
- Signed authorisation. No test without a written contract. It sets the scope, the dates, the exclusions and the person to alert on your side in an emergency.
- Testing. The tester looks for flaws without interrupting your business, and stops at the proof: no damage, no data taken away.
- Report. Each flaw is explained, ranked by severity, with its fix.
- Debrief. A conversation to go through everything and decide on priorities.
- Fix, then retest. Once the flaws are fixed, a new check confirms they are closed. The Ryze Cyber website does not say whether this retest is included in the price: ask when you request a quote.
What is in the authorisation contract?
This is the document that makes the test legal and free of surprises. The template shown on the website has four headings:
| Heading | What it sets | Why it matters |
|---|---|---|
| Scope | The systems tested: website, client area, access. | Anything not listed is left untouched. |
| Dates | A window agreed with you. | You know when it happens and can warn your hosting provider. |
| Exclusions | Tests that put availability at risk, excluded by default. | The risk of an outage during the test is reduced. |
| Emergency contact | One person on your side. | If something abnormal shows up, someone decides straight away. |
One point to check on your side: you can only authorise a test on systems that belong to you. If your website is hosted by a third party, look at what its terms say about security testing.
What is in the report?
The standard structure published by Ryze Cyber has five parts: a summary for management, free of jargon; the scope and its limits; the flaws by severity, from critical to low; the proof and the scenario for each flaw; a remediation plan in order of priority. A good report is read in two passes: management reads the first page, the person doing the fixing reads the rest.
What drives the price of a penetration test?
Ryze Cyber publishes its prices in euros and in Swiss francs, at the same amounts, excluding tax:
| Red Team plan | What is included | Published price |
|---|---|---|
| External scan | Exposed website and services, known credential leaks, prioritised summary report. | EUR 490 or CHF 490 |
| Full audit | Everything in the external scan, manual web and access tests, detailed report by severity, debrief by video call. | EUR 1,490 or CHF 1,490 |
| Full audit + AI | Everything in the full audit, tests of the AI tools connected to your data, supported remediation plan. | EUR 3,900 or CHF 3,900 |
Prices taken from the home page on 7 October 2026. One-off engagements.
The gap between these three lines shows what makes a price move, with any provider:
- The scope: a brochure website, a client area, accounts, an infrastructure, AI assistants. The more doors, the more work.
- The share of manual work: an automated survey costs less than a test carried out by a person.
- The level of detail in the report: a summary, or a detailed report with proof and scenario.
- The support: debrief, help with fixes, retest.
The six plans, Red Team and Blue Team, are detailed on the penetration test pricing page. If you are hesitating between an automated survey and a test, read scan or penetration test.
Ten questions to ask a provider
- What exactly is tested, and what is not?
- Is an authorisation contract signed before any test?
- How much of the work is automated, and how much is manual?
- Who carries out the test, and where are my data and the report stored?
- Are tests that put availability at risk excluded by default?
- Can I see a sample report?
- Does each flaw come with its proof and its fix?
- Is there a spoken debrief?
- Is a retest after the fixes included?
- Is the price fixed and written down before the start?
PASSI-qualified or independent provider?
PASSI is a French qualification. France's national cybersecurity agency, ANSSI, grants it to audit providers that meet its set of requirements, for activities such as configuration audits, source code audits or penetration tests. It is not a general obligation for a small business. Check whether your sector or one of your clients requires it. Ryze Cyber does not present itself as a PASSI-qualified provider: if this qualification is in your specifications, choose a provider from the ANSSI list.
Frequently asked questions
Is it legal to have my own company attacked?
Yes, provided you are the one asking, for systems that belong to you, and an authorisation contract is signed beforehand. Ryze Cyber never tests a third-party system without the written consent of its owner.
How much does a penetration test cost for a small business?
It depends on the scope and on the share of manual work. Ryze Cyber publishes EUR 490 for an external scan, EUR 1,490 for a full audit and EUR 3,900 for a full audit extended to AI tools, excluding tax. The amounts are the same in Swiss francs: CHF 490, 1,490 and 3,900 (prices taken on 7 October 2026).
How long does a penetration test take?
The duration depends on the scope. It is agreed with you as a window of dates written into the authorisation contract. Also ask on what date the report will be delivered.
Does a small business really need a penetration test?
Not always. For a brochure website with no sensitive data, an external scan can be enough. A test becomes useful as soon as there is a client area, sensitive data, or a requirement from a client or an insurer.
Why test AI tools as well?
An AI assistant or agent connected to your data can be manipulated into revealing information or acting on your behalf. It is a new entry point that conventional audits do not always cover.
Not ready for a test yet?
The Ryze Cyber free scan is a 10-question questionnaire. It takes two minutes, the score appears straight away and nothing is tested on your systems.
Read next
Sources
- Ryze Cyber, method, authorisation contract, report structure and published prices (taken on 7 October 2026)
- ANSSI (France), CyberDico: PASSI requirements for information system security audit providers, in French
Last updated: 7 October 2026