Pen testing · Security audits · Compliance readiness — New York, NY

The Outside Security Team for New York’s Growing Companies

I built Evanti so a forty-person company could get the same patient, methodical penetration test a bank pays for — scoped in writing, priced per engagement, and closed out with a remediation roadmap your team can actually finish.

Book a free 30-minute scoping call

or call me directly at (718) 403-9242

Who we test for

Medical & dental practices
Law & accounting offices
SaaS teams facing SOC 2
Nonprofits holding donor data

Every finding leaves our hands with the fix, a named owner, and the week it’s due.

A wrought-iron gate and brownstone stoop on a New York street at golden hour, railing shadows stretching across the steps

Finding EV-07High

Default admin password on the reception printer’s web panel

Owner: Office manager
Fix by: Week 1
Retest: Included

I started Evanti after watching small firms get quoted six-figure retainers for a single test, then get handed a two-hundred-page PDF nobody could act on. So we work one engagement at a time, we write in plain English, and we stay on the call until your team understands every finding.

The founder, on why Evanti works the way it does

We work from West 137th Street in New York, NY — testing remotely or on-site for companies across the city.

Tell me about your setup

The engagements

What We Test, and What It Costs Before We Begin

Every engagement opens with a one-page scope letter: targets, testing windows, who to call if something looks wrong, and the fee. You sign it before a single packet leaves our machines.

01

External Network Penetration Test

We go at your internet-facing footprint the way an outsider would — VPN gateways, mail, remote desktop, the staging subdomain someone forgot in 2021.

1–2 weeksUp to 32 public IPs

from$4,850Scope this →
02

Web Application Penetration Test

Authenticated testing against the OWASP Top 10 and, more importantly, your business logic — the checkout, the patient portal, the admin screen with one too many permissions.

2–3 weeksTwo user roles

from$7,400Scope this →
03

Internal Network & Active Directory

We start from one ordinary laptop on your network and show you how far a single phished employee could walk — file shares, domain admin, backups.

1–2 weeksOn-site or via test VM

from$6,350Scope this →
04

Security Audit

A controls review of Microsoft 365 or Google Workspace, endpoints, backups and cloud configuration, benchmarked against CIS so you know where you stand.

2 weeksNo downtime

from$3,900Scope this →
05

Compliance Readiness Assessment

A SOC 2, HIPAA or PCI DSS gap analysis: what your auditor will ask for, what you already have, and the shortest honest path to the rest.

3–5 weeksEvidence map included

from$5,600Scope this →
06

Retest After Remediation

Once your team has fixed things, we re-run every finding and reissue your attestation letter with closed items marked closed.

3–5 daysWithin 90 days of report

flat$1,350Scope this →

Fees are fixed once the scope letter is signed. Half at kickoff, half on delivery of the report.

Before you sign

The Questions Owners Ask Me on the First Call

Question one

Are We Really Big Enough to Need a Pen Test?

If you hold patient records, client tax files, card numbers or a customer database, attackers have already decided you’re big enough. Most of what we find at smaller firms is ordinary — an old VPN appliance, a shared admin login, MFA left off one mailbox — and ordinary is exactly what gets exploited. Our First Look at $3,900 is built to tell you honestly whether a full test is worth your money yet.

Can’t you just run a scanner?

Scanners are in our kit, not the product. A scanner reports a missing patch; we show you that the missing patch plus one reused password gets someone into payroll.

Question two

Will Your Testing Knock Anything Offline?

We set testing windows with you in the scope letter — usually after 7pm for production systems — and we leave denial-of-service techniques out unless you ask for them in writing. Your point of contact gets my mobile number. If anything looks unstable, we stop, call, and wait for your go-ahead.

Do my staff need to know?

Your IT lead or managed-service provider should. Everyone else is your call — for phishing exercises we usually brief only the owner.

Question three

What Exactly Do We Get at the End?

A two-page executive summary you could hand your board, a findings ledger with evidence and reproduction steps for your IT team, and a 30 / 60 / 90-day remediation roadmap. Every finding names the fix, a suggested owner, and the week it should be done. Then a 60-minute readout call where we walk through it together.

Can our insurer or a client see it?

Yes — we issue a separate attestation letter that confirms the test and its scope without exposing your vulnerabilities to anyone outside your walls.

Question four

What Should We Have Ready for Kickoff?

Your domains and public IP ranges — a screenshot of your DNS panel is fine.
Two test accounts for each app in scope: one ordinary user, one admin.
A named emergency contact who will pick up during the testing window.
Any policies you already have, plus last year’s audit letter if one exists.

If you only have half of this, that’s normal. Gathering it together is often the first genuinely useful hour of the engagement.

Turn on MFA for the four mailboxes that still allow basic sign-in — this week. Everything else on this page can wait for Thursday’s call.

A line from a sample Evanti roadmap. Plain verbs, a real deadline, and an order of operations — that’s how every page reads.

The deliverable

Inside the Roadmap We Hand You

Executive summary: 2 pages, written for owners and boards, not engineers.
Findings ledger: Severity, CVSS 3.1 score, evidence screenshots and exact reproduction steps.
Remediation roadmap: 30 / 60 / 90-day sequence with a suggested owner on every line.
Readout call: 60 minutes with your team; recorded if you’d like to share it.
Attestation letter: For insurers, clients and auditors — scope and dates, no exploit details.
Retest window: Included in The Full Test and Audit-Ready; $1,350 otherwise.
Evidence handling: Encrypted at rest, destroyed 90 days after the engagement closes.

Start here

Choose an Engagement, Then Let’s Settle the Scope

These are the three shapes most of our work takes. Pick the one closest to where you are; the scoping call is free and we’ll adjust from there.

About 2 weeks

The First Look

$3,900

Security audit of Microsoft 365 or Google Workspace
External attack-surface review of your domains
12-page roadmap and a 45-minute readout

Ask about The First Look

Most chosen 3–4 weeks

The Full Test

$9,750

External network + one web application penetration test
Findings ledger with evidence and a 30 / 60 / 90 roadmap
One retest and an attestation letter

Scope The Full Test

6–8 weeks

Audit-Ready

$14,200

SOC 2, HIPAA or PCI DSS readiness gap assessment
Internal + external penetration test and policy review
Auditor-facing evidence map, two retests, monthly check-ins for six months

Plan for Audit-Ready

Write to Me About Your Setup

A few lines is plenty — how many people you have, what you’re worried about, and whether there’s an audit or client questionnaire on the calendar. I reply within one working day.