On 25 November 2024, the New York State Department of Financial Services (DFS) signed a consent order finding that GEICO had violated 23 NYCRR 500.5, the penetration testing section of its cybersecurity regulation, as it then read: GEICO "was not conducting annual penetration testing, as required by Section 500.5 of the Cybersecurity Regulation in the absence of effective continuous monitoring". Its principal test was a 2018 third-party "penetration test/risk assessment" that "was limited in scope" and did not evaluate the claims website or the agent portal, and attackers later pulled New Yorkers' driver's license numbers from the claims website and from the portal's API. An auditor's advice to test "GEICO's most critical applications" went unheeded: "no such tests were performed." DFS imposed a US$5 million penalty for that and six other violations, part of US$9.75 million secured with the New York Attorney General (DFS release).
Two 2025 orders turned on testing too. A PayPal change "went live with NPI unmasked" after "a risk assessment, penetration test, and/or vulnerability scan of this change did not occur" (US$2 million). State Automobile Mutual's penetration tests "identified weak passwords on multiple occasions", fixed only in "February of 2022, a year after the Cybersecurity Event occurred" (US$2.5 million).
Since 29 April 2024, section 500.5(a)(1) has required testing "from both inside and outside the information systems' boundaries" at least annually, with no continuous-monitoring alternative, and on 10 September 2026 DFS said covered entities must use their risk assessments to inform their "testing plans" (DFS guidance). This ranking is for mid-market and enterprise covered entities: banks, insurers including health insurers, mortgage bankers and servicers, money transmitters and virtual currency businesses licensed in New York, including Canadian and foreign groups with a New York licence or branch. For the rule in depth, see our NYDFS penetration testing requirements guide.
Quick answer. The best NYDFS penetration testing companies in 2026 are Stingrai, Kroll, NCC Group, NetSPI, Pen Test Partners, GuidePoint Security, Protiviti, Praetorian, CyberCX, TrustedSec and Coalfire. Stingrai ranks first: a CREST-accredited, Toronto-headquartered firm whose named penetration testers cover both sides of the 500.5(a)(1) boundary, from the perimeter to the internal network, Active Directory, applications and cloud. Retesting is included and every human-led and hybrid report ships with an attestation letter, as a one-time annual test or a continuous program. Kroll suits buyers who want a New York-headquartered firm, and NCC Group publishes a testing service built around Part 500.
What drives a penetration test at a NYDFS covered entity
Covered entities must keep vulnerability management policies "designed to ensure" the testing below. Quotes come from DFS's adopted Second Amendment text, effective 1 November 2023; DFS also publishes an unofficial consolidated copy.
Provision | Verb | What the text says | What to ask a vendor for |
|---|---|---|---|
500.5(a)(1) | shall | "penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually" | Separate internal and external components, named testers |
500.1(l) | defines | testing "by authorizing attempted penetration of databases or controls from outside or inside the covered entity's information systems" | Signed authorization and rules of engagement |
500.5(a)(2) | shall | "automated scans of information systems, and a manual review of systems not covered by such scans", at a risk-based frequency "and promptly after any material system changes" | Capacity to test material changes |
500.5(c) | shall | "timely remediate vulnerabilities, giving priority to vulnerabilities based on the risk they pose to the covered entity" | A severity method and an included retest |
500.9(a) | shall | risk assessment updated "at a minimum annually, and whenever a change in the business or technology causes a material change" to cyber risk | A scope traced to the risk assessment |
500.17(b)(3) | shall | records kept "for a period of five years", including "all remedial efforts undertaken" and "remediation plans and timelines for their implementation" | A retest report and remediation record you can keep |
500.2(c), 500.7(c), 500.14(b) | shall (Class A) | independent audits; privileged access management and blocking of "commonly used passwords"; endpoint detection covering "lateral movement" and centralized logging | Inside-the-boundary testing that exercises those controls |
Who is covered. Section 500.1(e) reaches anyone operating under a licence or similar authorization "under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether the covered entity is also regulated by other government agencies"; 500.1(r) names "a branch or agency of a foreign banking organization subject to this Part". The 500.19(a) limited exemption (fewer than 20 employees and contractors, under US$7.5 million in revenue, or under US$15 million in assets) lifts 500.5.
Class A companies (500.1(d): at least US$20 million in gross annual revenue in each of the last two fiscal years, plus more than 2,000 employees or more than US$1 billion in revenue, counting affiliates as the rule sets out) face the same test plus the controls in the table's last row.
DFS's 2026 guidance. The September 2026 letter says the risk assessment "should incorporate" inputs including "penetration testing" and must inform "testing plans"; it "does not create new obligations."
What DFS enforcement says about penetration testing
Of the 2024 to 2026 DFS orders we read (see References), GEICO's is the one that finds a 500.5 violation, under the pre-November 2023 text that allowed continuous monitoring instead of annual testing. Genesis Global Trading's January 2024 order cites 500.5 only in describing the rule, and the PayPal and State Auto findings sit under 500.3, 500.10, 500.12 and related sections. The lessons:
Scope must reach the systems that hold nonpublic information. GEICO's 2018 test skipped the claims website and agent portal that attackers later used, the portal through its API.
A finding is not closed until a retest says so. State Auto's penetration tests flagged weak passwords more than once, and DFS treated the inaction as a failure to implement its own policies under 500.3.
Material changes need testing before release. Contrary to PayPal's own change policy, "a risk assessment, penetration test, and/or vulnerability scan of this change did not occur".
The certification rests on the evidence. DFS held GEICO's compliance certifications for 2017 to 2021 "improper".
What mid-market and enterprise covered entities need from a vendor
Both halves, reported separately. Scope the perimeter and remote access, the internal network and Active Directory from an assumed-breach position, portals and APIs, and cloud accounts as distinct items. Severity concentrates inside: in Stingrai's State of Penetration Testing 2026 data, 92% of internal network findings were rated High or Critical (8 tests), against 54% for web applications (40 tests).
Named, qualified testers. Named, certified testers and firm-level accreditation are portable evidence that the party is "qualified"; our CREST guide for the USA and Canada shows how to check a claim.
The five-year evidence package. Scope statement, signed authorization, report, remediation record, retest report and a plan for open items, held in a platform. The certification due each 15 April covers the prior calendar year (500.17(b)), so run the annual test inside the year it certifies.
Capacity for material changes. Sections 500.5(a)(2) and 500.9(a) turn on material change; a continuous program or retained testing days cover releases between annual tests.
Class A control validation. Ask what your endpoint detection and logging (500.14(b)) saw, and whether privileged access controls (500.7(c)) held.
Multi-entity scoping. Reports that map to each licensed entity's certification; Canadian groups can cover NYDFS and OSFI B-13 in one engagement.
Contracting entity and data handling. Confirm which entity signs and delivers and where evidence is stored. A tester permitted access to nonpublic information is a third-party service provider under 500.1(s), so your 500.11 policies apply.
How this ranking was built
Every vendor claim traces to the vendor's own website or CREST Marketplace profile, checked on 13 October 2026. The first two criteria were gates; the other three were weighed together.
Both sides of the boundary: perimeter testing plus inside-the-network work (internal testing, Active Directory or lateral movement) named on the firm's own site.
Checkable qualification: CREST Penetration Testing accreditation for an entity matching the firm's own website.
Part 500 fit: Part 500 or financial-sector testing material on the firm's site.
New York presence: a New York office counts in a firm's favour but is not required.
Usable evidence: retesting, remediation tracking and reporting that supports the certification.
At a glance: NYDFS penetration testing companies
Company | Head office | New York presence | Evidence a buyer can check | Best for |
|---|---|---|---|---|
1. Stingrai | Toronto, Canada | Remote and on site where scoped | CREST; same-day findings, retest, attestation letter | Both halves, named testers, annual or continuous |
2. Kroll | New York, USA | Headquarters, One World Trade Center | CREST IR, Penetration Testing and SOC (Kroll LLC) | IR and testing in one New York entity |
3. NCC Group | Manchester, UK | None listed; Chicago and Waterloo offices | Part 500 testing page; ten CREST accreditations | A service built around Part 500 |
4. NetSPI | Minneapolis, USA | None listed; Toronto office | CREST; mainframe testing | Banks and insurers with mainframes |
5. Pen Test Partners | Buckingham, UK | Pen Test Partners Inc, 115 Broadway | Seven CREST accreditations incl. CBEST and STAR-FS services | New York arms of UK and EU groups |
6. GuidePoint Security | Reston, Virginia, USA | 250 West 34th Street | CREST; PTaaS, purple and red team | Enterprises consolidating partners |
7. Protiviti | Menlo Park, California (release dateline) | 888 7th Avenue | CREST (UK entry); regulatory compliance practice | Testing with regulatory advice |
8. Praetorian | Austin, USA | None listed | CREST; names NYDFS among annual test requirements | Annual testing inside an exposure program |
9. CyberCX | Melbourne, Australia | 230 Park Avenue | CREST (Australian entry); part of Accenture | Groups operating across the US, UK and Australia |
10. TrustedSec | Fairlawn, Ohio, USA | None listed | CREST; retest of remediated findings | Retest and incident response from one firm |
11. Coalfire | Chicago, USA | None listed | CREST (UK entry); PCI QSA and FedRAMP 3PAO | Testing with assessment depth |
1. Stingrai (top rated for NYDFS covered entities)
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a covered entity, the case is evidence that holds up for five years. Stingrai Inc, the company that signs the contract, holds the CREST Penetration Testing accreditation (Marketplace profile). Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner. The team has 18 published CVEs and Hall of Fame listings at the US Federal Reserve and the US Department of Defense, and Stingrai is rated 5.0 out of 5 on Clutch (20 reviews).
Scope for a Part 500 test
Outside the boundary: the external network, remote access, and web applications and APIs such as banking portals, tested across every user role for broken authorization and IDOR.
Inside the boundary: the internal network, segmentation and Active Directory privilege paths from an assumed-breach position; purple teaming with your SOC shows whether detection caught the lateral movement.
Cloud and people: cloud accounts, phishing and vishing for the training in 500.14(a)(3), and red teaming.
Delivery and evidence
Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a working proof of concept and prioritized remediation guidance, so remediation under 500.5(c) starts before the report. Retesting is included, and every human-led and hybrid report ships with an attestation letter: pentest evidence for your NYDFS, SOC 2, ISO 27001 and PCI DSS program. The annual test can be scheduled inside the year your certification covers, and a continuous program tests every release. From Toronto and its London, UK office, Stingrai serves New York clients remotely and on site where the scope calls for it.
Where Snipe fits
Snipe is Stingrai's autonomous AI agent for web applications and associated APIs only. Trained on more than 6,000 HackerOne Hacktivity reports, it hunts IDOR, broken authorization and business logic flaws and opens AutoFix pull requests. The Autonomous Pentest is Snipe alone, with no penetration testers; in the Hybrid Pentest, Snipe and penetration testers test together, with the testers directing its focus. Everything else is human-led.
Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). A full Part 500 scope is quoted through get a quote. Best for: covered entities that want both halves of the 500.5(a)(1) test from named, certified testers at a CREST-accredited firm, with the remediation record and retest built in, as a one-time annual test or a continuous program.
2. Kroll
Kroll's About page says "Kroll Is Headquartered in New York", at One World Trade Center. Its Marketplace entry, Kroll LLC, holds Incident Response, Penetration Testing and Security Operations Centre accreditations. Kroll's penetration testing datasheet lists internal and external network, web application, API, mobile, cloud and AI/LLM testing and red team services, and "over 100,000 hours of cyber security assessments completed each year". Testing and the incident response behind the 72-hour notice in 500.17(a) sit in one accredited entity.
Best for: covered entities that want a New York-headquartered firm with incident response and testing in one CREST-accredited entity.
3. NCC Group
NCC Group is headquartered in Manchester, UK; its office list gives Chicago as its North American regional headquarters, plus Waterloo, Ontario. On 4 March 2026 it published a Part 500 guide describing "NYCRR 500 penetration testing services": "risk-based, independent testing of external, internal, cloud, and application environments", reporting for "annual certification requirements under NYCRR 500", and "optional retesting to validate corrective actions". Its Marketplace entry holds ten CREST accreditations, including Penetration Testing and TLPT-FS Threat Led Penetration Testing. Retesting is optional, so price it in.
Best for: covered entities that want a testing service designed around Part 500 from the broadest CREST profile on this list.
4. NetSPI
NetSPI is headquartered in Minneapolis with an office in Toronto (contact), and its home page says it "has led security innovation since its inception in 2001". Its Marketplace entry lists Penetration Testing and Threat Led Penetration Testing (Formerly STAR ILPT). Its mainframe testing covers z/OS, CICS and "RACF/TopSecret/ACF2 configurations", systems it says are often "passed over during reviews". Its merger with Synack, announced on 2 September 2026, was completed on 5 October 2026, and NetSPI says customers "should continue working with their existing teams under their current agreements".
Best for: large banks and insurers with mainframe estates that want testing delivered on a PTaaS platform.
5. Pen Test Partners
Pen Test Partners has worked "since 2010" and lists its UK office in Buckingham and a US office, Pen Test Partners Inc, at 115 Broadway in New York (About). Its penetration testing page lists internal and external infrastructure testing and names finance among its sectors. Its Marketplace entry holds seven accreditations and lists the Bank of England's CBEST and STAR-FS services, and it offers red teaming for CBEST, GBEST, STAR-FS and TIBER. The entry is the UK company, so name the delivering entity in the contract.
Best for: New York branches and subsidiaries of UK and EU financial groups that also face CBEST or TIBER-style threat-led testing.
6. GuidePoint Security
GuidePoint Security lists its headquarters in Reston, Virginia and an office at 250 West 34th Street in New York (contact). Its penetration testing page covers "internal or external networks, applications, cloud, ICS, security awareness or facilities" using "controlled exploitation, detailed evidence and concise reporting", plus a PTaaS platform and purple and red team assessments, and its contact page says it is "Relied on by 40% of the Fortune 500". Its Marketplace entry lists Penetration Testing.
Best for: enterprises that want testing from a partner they may already use for security products, with a Manhattan office.
7. Protiviti
Protiviti, a consulting firm that datelines its releases from Menlo Park, California, lists a New York office at 888 7th Avenue (locations). Its attack and penetration page covers red teaming, application security, network penetration testing and social engineering, with a methodology that includes "exploitation, privilege escalation and lateral movement". Its regulatory compliance team includes former "financial regulators" and helps clients "respond successfully to enforcement actions and consent orders". Its Marketplace entry lists Penetration Testing with a United Kingdom head office, so confirm which entity delivers your test.
Best for: covered entities that want testing alongside regulatory remediation advice from a consulting firm with a Manhattan office.
8. Praetorian
Praetorian "was founded in 2010" (newsroom) and is headquartered in Austin, Texas (newsroom). Its penetration testing page describes "external and internal penetration testing" across "systems, Active Directory, and network infrastructure", delivered through its Guard platform, and its home page lists NYDFS among the annual penetration test requirements it says its program satisfies. Its Marketplace entry lists Penetration Testing.
Best for: enterprises that want the annual NYDFS test folded into a continuous exposure program on the vendor's platform.
9. CyberCX
CyberCX, "part of Accenture", describes itself on its US site as a provider "across the United States, United Kingdom, Australia and New Zealand", with headquarters in Melbourne (contact) and a US office at 230 Park Avenue in New York (US contact). Its penetration testing page lists external and internal network penetration testing. Its Marketplace entry, CyberCX Pty Ltd, holds Incident Response, Penetration Testing and Security Operations Centre accreditations with an Australian head office, so confirm which entity delivers your test.
Best for: groups licensed in New York that also operate in the UK, Australia or New Zealand and want one provider across them.
10. TrustedSec
TrustedSec was "Founded by innovator David Kennedy in 2012" (home page) and is based in Fairlawn, Ohio (contact). Its penetration testing page includes "Validation Testing: After you've addressed identified vulnerabilities, we retest to confirm they've been successfully mitigated", and its Active Directory assessment maps "privilege escalation paths". Its Marketplace entry lists Penetration Testing and describes "Incident Response, penetration testing, purple teaming, and red teaming" among its services.
Best for: mid-market covered entities that want a retest in the base engagement and incident response from the same firm.
11. Coalfire
Coalfire is "headquartered in Chicago, Ill.", according to its August 2026 release, and lists no New York office. Its offensive security datasheet covers network testing "for external, internal, cloud, or hybrid topologies" and red teaming, and its assessment page cites "15+ years as a PCI Qualified Security Assessor" and FedRAMP 3PAO work. Its Marketplace entry, Coalfire Systems, lists Penetration Testing with a United Kingdom head office, so confirm the delivering entity.
Best for: covered entities that want testing from a firm with PCI DSS and FedRAMP assessment depth.
Also considered
Two firms did not pass the CREST gate. Rapid7, based in Boston, sells external and internal network, web application, social engineering and red team testing (Rapid7) and publishes an NYDFS explainer, but no Marketplace entry carried its name on 13 October 2026. Optiv, headquartered in Leawood, Kansas, says its "penetration testing services serve 64% of the Fortune 500" (Optiv), but its Marketplace entry, Optiv Services LLC, links to a different website, so we could not match it to the firm.
What a NYDFS penetration test costs
DFS sets no price, so cost follows the scope 500.5(a)(1) implies: perimeter, internal network and Active Directory, applications and APIs, cloud and the retest. Our NYDFS requirements guide lists price bands by component, and the pentest cost calculator turns asset counts into an estimate. Stingrai's fixed packages are the Autonomous Pentest at US$3,000 and the Hybrid Pentest at US$6,800 per assessment, each for one web application and associated APIs (pricing); a Part 500 scope is quoted. Check that each proposal prices the retest and both halves of the boundary (how to compare penetration testing quotes).
RFP questions for a NYDFS penetration test
[ ] Which legal entity signs, which delivers the test, and does the accredited entity match?
[ ] Are the internal (assumed breach, Active Directory) and external components scoped and reported separately?
[ ] Who are the named testers, is a written retest included, and can we keep the records five years?
[ ] Will the rules of engagement be signed by someone with authority to authorize the test?
[ ] How does your severity method map to our remediation timelines under 500.5(c)?
[ ] How quickly can you test a material change between annual tests?
[ ] Where are findings and evidence stored, and is any work subcontracted?
Our penetration testing RFP template turns these into a document.
Frequently Asked Questions
Who are the best NYDFS penetration testing companies in 2026?
The best NYDFS penetration testing companies in 2026 are Stingrai, Kroll, NCC Group, NetSPI, Pen Test Partners, GuidePoint Security, Protiviti, Praetorian, CyberCX, TrustedSec and Coalfire. Stingrai ranks first: its named penetration testers cover both sides of the 500.5(a)(1) boundary, retesting is included, and every human-led and hybrid report ships with an attestation letter, as a one-time annual test or a continuous program.
Does NYDFS require penetration testing?
Yes. Section 500.5(a)(1) of 23 NYCRR Part 500 requires "penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually", with compliance due from 29 April 2024 under 500.22. Entities within the 500.19(a) limited exemption are exempt.
Can an internal team perform the NYDFS penetration test?
Yes, if it is qualified. The rule allows "a qualified internal or external party", so hiring an external firm is a choice that makes independence easier to evidence, not a mandate.
What penetration testing evidence should a covered entity keep for DFS?
Section 500.17(b)(3) requires five years of records, including "all remedial efforts undertaken" and "remediation plans and timelines for their implementation": the scope, authorization, report, remediation record, retest report and plan for open items.
Has DFS penalized a company over penetration testing?
Yes. DFS's November 2024 consent order found that GEICO violated the pre-2023 version of 500.5 by running neither effective continuous monitoring nor annual penetration testing; its US$5 million penalty covered seven violations. In 2025, PayPal's order described a change that went live after a risk assessment, penetration test and/or vulnerability scan did not occur, and State Automobile Mutual's described penetration test findings left unfixed for a year.
Do Class A companies have extra penetration testing requirements?
Not for the test itself, which is the same for every non-exempt covered entity. Class A companies add independent audits (500.2(c)), privileged access management and password blocking (500.7(c)), and endpoint detection and centralized logging (500.14(b)).
Does NYDFS Part 500 apply to Canadian banks and insurers?
Yes, where they hold a New York licence or similar authorization under the Banking Law, Insurance Law or Financial Services Law; the rule names "a branch or agency of a foreign banking organization subject to this Part." Reinsurers recognized only under 11 NYCRR Part 125 are exempt under 500.19(g). A Canadian group can design one test for NYDFS and OSFI B-13.
How much does a NYDFS penetration test cost?
DFS sets no price, so cost follows scope. Stingrai's fixed packages are US$3,000 (Autonomous) and US$6,800 (Hybrid) per assessment for one web application and associated APIs; a full Part 500 scope across networks, Active Directory and cloud is quoted.
Related reading
References
DFS, Second Amendment to 23 NYCRR 500 (adopted text), effective 1 November 2023. https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf
DFS, Assessment of Public Comments on the Revised Proposed Second Amendment to 23 NYCRR Part 500. https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_apc_20231101.pdf
DFS, Cybersecurity Implementation Timeline for Covered Entities. https://www.dfs.ny.gov/system/files/documents/2023/11/cybersecurity_implementation_timeline_covered_entities.pdf
DFS, Cybersecurity Regulation 23 NYCRR Part 500 (unofficial consolidated copy). https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500
DFS, Consent Order, Government Employees Insurance Company, 25 November 2024, and joint press release. https://www.dfs.ny.gov/system/files/documents/2024/11/ea20241125-geico.pdf and https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20241125
DFS, Consent Order, PayPal, Inc., 23 January 2025. https://www.dfs.ny.gov/system/files/documents/2025/01/ea20250123-paypal-inc.pdf
DFS, Consent Order, State Automobile Mutual Insurance Company, 14 October 2025. https://www.dfs.ny.gov/system/files/documents/2025/10/ea20251014-co-state-auto-mutual-ins-company.pdf
Other DFS orders read: Genesis Global Trading (2024), Travelers (2024), Block (2025, BitLicense cybersecurity findings), Healthplex (2025), seven further auto insurers (2025), Delta Dental and Order Express (2026). https://www.dfs.ny.gov/cybersecurity
DFS, Guidance on How to Conduct and Use Risk Assessments, 10 September 2026. https://www.dfs.ny.gov/industry_guidance/industry_letters/il20260910-cyber-risk-assessment
CREST Marketplace supplier profiles linked in each entry, opened 13 October 2026. https://marketplace.crest.org/suppliers/
Stingrai, State of Penetration Testing 2026. https://www.stingrai.io/reports/state-of-penetration-testing-2026
Vendor pages linked in each entry, fetched 13 October 2026.
Talk to Stingrai
Bring your risk assessment and last year's report. Stingrai will scope both halves of the 500.5(a)(1) test, name the penetration testers, post every confirmed finding the same day, retest the fixes and close human-led and hybrid engagements with an attestation letter, as a one-time annual test timed to your certification year or a continuous program. Get a quote or see the published packages on the pricing page.
