Best Penetration Testing Companies in Chicago (2026): Illinois Providers Compared

The penetration testing companies we recommend for Chicago and Illinois buyers in 2026 are Stingrai, HALOCK Security Labs, Coalfire, Netrix Global and Sikich. Stingrai ranks first: it is a CREST-accredited penetration testing service provider at the firm level, rated 5.0 out of 5.0 across 19 Clutch reviews, and it runs Snipe, an autonomous AI agent for web application penetration testing that works alongside its certified penetration testers on every engagement. The four Illinois-based firms behind it each publish an Illinois street address on their own site and each sells penetration testing as a named service.

Illinois prices security failure differently from every other state. Section 20 of the Biometric Information Privacy Act gives any aggrieved person a private right of action and sets liquidated damages of US$1,000 for each negligent violation and US$5,000 for each intentional or reckless violation, plus attorneys' fees and costs. No regulator has to act first. That is why a Chicago company handling fingerprints, face templates or voiceprints treats an authorization flaw in its own application as a litigation exposure rather than a compliance finding.

Below is a ranking of the firms serving Chicago's trading firms, banks, insurers, health systems and SaaS companies, analyzed by verified Illinois presence, testing depth, independent accreditation, fit with PIPA and BIPA, remediation support and pricing transparency. We also include 2026 USD pricing benchmarks and a buyer's checklist.

Penetration Testing Companies in Chicago at a Glance (2026)

Illinois addresses in rows 2 to 5 are quoted from each firm's own published site content, fetched in September 2026. Founding years appear only where the vendor publishes one.

Best Pentest Companies in Chicago: Quick Answers

Which is the best penetration testing company in Chicago?

Stingrai is the penetration testing company we recommend first for Chicago and Illinois organizations in 2026. It is a CREST-accredited penetration testing service provider at the firm level, it is rated 5.0 out of 5.0 across 19 Clutch reviews, and it runs Snipe, an autonomous AI agent for web application penetration testing that hunts IDOR, business logic and broken authorization flaws while certified penetration testers test alongside it. Retesting is included in every engagement and package pricing is published openly rather than gated behind a sales call.

What are the top penetration testing firms based in Illinois?

HALOCK Security Labs, Coalfire, Netrix Global and Sikich are the Illinois-based firms we recommend, and each publishes an Illinois address alongside a named penetration testing service. HALOCK is the Schaumburg specialist with the deepest scope list. Coalfire brings an offensive security practice attached to two decades of third-party assessment work in regulated environments. Netrix Global covers six attack surfaces including physical entry and includes remediation retesting. Sikich carries testing inside an audit, PCI and compliance relationship that many Illinois mid-market companies already hold.

Do Illinois companies legally need a penetration test?

No Illinois statute names penetration testing. Section 45 of the Personal Information Protection Act requires a data collector to "implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure". Section 15(e) of the Biometric Information Privacy Act requires a private entity to store, transmit and protect biometric identifiers "using the reasonable standard of care within the private entity's industry". Both are reasonableness standards judged after the fact. What forces the purchase in practice is a SOC 2 or PCI DSS audit, a broker-dealer or bank examination, an enterprise customer's security review, or a BIPA claim.

Why Chicago Pentest Demand Is Rising in 2026

Two statutes, one industry mix and one litigation dynamic shape most Illinois buying.

_Figure 1: What drives Illinois penetration testing budgets. Sources: Illinois General Assembly, 815 ILCS 530 and 740 ILCS 14._

PIPA sets the Illinois floor and a 500-resident trigger

The Personal Information Protection Act has applied since 1 January 2006. Section 45, added by Public Act 99-503 with effect from 1 January 2017, is the operative security duty: "A data collector that owns or licenses, or maintains or stores but does not own or license, records that contain personal information concerning an Illinois resident shall implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure."

Section 45(b) pushes the same duty down the supply chain. A contract disclosing personal information about an Illinois resident "must include a provision requiring the person to whom the information is disclosed to implement and maintain reasonable security measures". If you sell software to an Illinois enterprise, their obligation becomes your contract clause.

Section 10 sets the failure path. Notice to affected residents must be made "in the most expedient time possible and without unreasonable delay", and any data collector required to notify more than 500 Illinois residents from a single breach must also notify the Attorney General, including a description of the nature of the breach, the number of residents affected and the steps taken.

The word "penetration" does not appear anywhere in the Act. What makes security measures reasonable is decided afterwards, and a documented test with reproduction steps, severity ratings and verified remediation is the standard way an Illinois organization shows the measures were more than a policy document.

BIPA turns an authorization bug into a lawsuit

The Biometric Information Privacy Act has applied since 3 October 2008 and is the reason Illinois is the most litigated privacy jurisdiction in the United States. Section 15(e) requires a private entity in possession of biometric identifiers or biometric information to "store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity's industry", and to do so "in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information".

Section 20 supplies the teeth: liquidated damages of US$1,000 against a private entity that negligently violates the Act, US$5,000 where the violation is intentional or reckless, plus reasonable attorneys' fees, expert witness fees and injunctive relief. A 2024 amendment limited repeated collection of the same identifier from the same person by the same method to a single violation, which reduced the arithmetic without removing the exposure.

For a Chicago product team, the practical consequence is that the classes of defect a penetration test is best at finding, broken object level authorization, IDOR and business logic flaws, are exactly the ones that expose a biometric template to someone who should not see it.

Trading, banking and healthcare raise the bar again

Chicago's derivatives exchanges, proprietary trading firms, banks and insurers answer to examiners as well as to Illinois statute, and its academic health systems carry HIPAA on top of PIPA. Two of the ranked firms name that directly: Coalfire aligns its testing to PCI, HIPAA and FedRAMP, and Sikich names PCI ASV, DSS and PIN work, HIPAA and HITRUST, and financial services cyber regulation in the same practice as penetration testing.

The scope consequence is consistent. Internal network and Active Directory testing matter more here than in a market dominated by cloud-native startups, because trading and health estates still run substantial on-premises identity.

What testing actually finds

Stingrai's State of Penetration Testing 2026 report analyzed 1,206 verified findings across 55 penetration tests. 51 of the 55 tests, or 92.7 percent, surfaced at least one High or Critical finding. Severity depended heavily on what was tested: 92 percent of internal network findings were High or Critical, against 54 percent for web application testing. Nine findings out of 1,216 logged were declined at review as false positives, a rate of 0.74 percent, and the median Critical issue was fixed in 10.5 days.

For an Illinois buyer, the second number is the useful one. An organization that only ever tests the public web application leaves the higher-severity half of the estate unexamined, and internal network testing is exactly the scope a bank examiner or a health system risk assessment will point at.

Quick Comparison: Best Pentest Firms in Chicago

How We Ranked These Companies

Every firm in this guide had to clear three eligibility gates. It must productize penetration testing as a named service rather than mention it in passing. It must have a verifiable Illinois presence, meaning an Illinois street address published on its own site, or a stated ability to deliver to Illinois buyers. And its core claims must be verifiable on its own website or in a public registry.

Ranking then weighed six criteria:

1. Verified Illinois presence, confirmed from a street address on the firm's own site rather than a directory listing or a city landing page.

2. Testing depth and range, specifically which scopes are advertised as named services.

3. Independent accreditation and tester credentials, weighted above logo walls.

4. Fit with PIPA Section 45 and BIPA Section 15(e), including whether the firm covers internal as well as external scopes.

5. Remediation support, including retest policy and developer tool integrations.

6. Pricing transparency, or a fast published quote path.

Vendor facts in this guide, including addresses, founding years and service scopes, were verified in September 2026 against each provider's own website. Claims that could not be reached on at least one verification pass against a named primary source were dropped rather than estimated, which is why several firms that appear on other Chicago lists are absent here. Founding years appear only where the vendor publishes one.

1. Stingrai (Top Rated for Illinois Buyers)

Stingrai is ranked the best penetration testing company for Chicago and Illinois buyers in 2026 for organizations that need testing evidence a SOC 2 auditor, a bank examiner or an enterprise security reviewer will accept. Founded in 2021 and headquartered in Toronto, with a London, UK office, it serves Illinois clients remotely on both one-time annual engagements and continuous PTaaS programs.

The thing that separates Stingrai from a conventional consultancy is how the engagement is staffed. Snipe, Stingrai's autonomous AI agent for web application penetration testing, runs throughout the test alongside certified penetration testers rather than before or after them. Snipe is built to hunt the classes that generic AI tooling misses: IDOR, business logic flaws and broken authorization. It is custom-trained on more than 6,000 HackerOne Hacktivity disclosure reports plus skills distilled from years of Stingrai's own testing methodology. It performs black-box dynamic testing and white-box source review, generates AutoFix pull requests for what it finds, and can run as a pull-request gating check that blocks vulnerable code from merging. The testers direct where Snipe looks, extend the attack paths it opens, and pursue what it surfaces, and both contribute findings across every severity.

The time difference is one hour. Toronto runs on Eastern Time, so a 9:00 kickoff in Chicago is a 10:00 call for the test team, and daily check-ins, triage and debriefs sit inside a normal Central Time working day. Reports and retest results are delivered against Illinois business dates.

At a Glance

Why Stingrai Ranks First for Chicago

• Firm-level CREST accreditation. An auditor or examiner asking whether the tester was qualified gets a registry-backed answer, not a resume.

• Both sides of the boundary in one engagement. Internal and external network testing alongside web application testing covers the on-premises identity that Chicago trading and health estates still run.

• Snipe hunts the bugs behind BIPA exposure. Broken authorization, IDOR and business logic flaws in customer-facing applications are how a biometric template reaches someone who should not see it.

• One hour from Central Time. Scoping, kickoff and debrief calls land inside an Illinois working day.

• Annual and continuous, not one or the other. An Illinois scale-up that needs one clean report before an enterprise deal can buy a single scoped engagement. A company shipping weekly can run a continuous program. Both are standard.

• Retesting is included, so fixes are verified inside the same engagement rather than becoming a separate purchase order.

• Published pricing, on the pricing page rather than behind a discovery call.

Pros

• Every finding is manually validated, so the report that reaches your auditor does not carry scanner noise.

• Retesting is included in every engagement rather than sold separately.

• Findings push directly into Jira, GitHub and Slack, so remediation happens where developers already work.

• Package pricing is transparent, which makes budget approval faster at an organization without a dedicated security hire.

Cons

• No Chicago office, so buyers who need testers physically on site for a facility walk-through, badge cloning or on-site social engineering should raise travel during scoping.

• Newer brand than the Illinois consultancies and national accounting firms, which matters to buyers who weigh name recognition over technical depth.

• Trading floor and market data infrastructure scopes should be defined explicitly during scoping rather than assumed.

Best for: Illinois SaaS, fintech, insurance and healthcare organizations that need internal and external testing from a CREST-accredited firm, delivered as either a one-time annual test or a continuous program.

Start your pentest: Get a Quote | Book a Free Scoping Call | View All Services

2. HALOCK Security Labs

**HALOCK Security Labs** states on its own site that it "is a U.S.-based risk and information security consulting firm that is privately owned and operated out of its headquarters in Schaumburg, IL", with the address published as 1834 Walden Office Square, Suite 200, Schaumburg, IL 60173. It does not publish a founding year, though it states "more than three decades of experience testing networks, applications, wireless environments, and security controls".

Its penetration testing practice carries the deepest named scope list of any Illinois firm here: external network, internal network, internal wireless, web application, assumed breach, adversary simulation, red team, remediation verification and remote social engineering. The firm describes reports that go beyond a vulnerability list to include attack-path evidence, criticality ratings and remediation guidance, and it states that manual investigation drives the work rather than tooling alone.

Pros

• Nine named testing scopes, including assumed breach and remediation verification as separate products rather than upsells.

• A genuine Illinois headquarters, which matters for on-site work and for buyers who want a local supplier on the invoice.

• Testing-first practice. Security consulting is the whole business, not a line inside an IT services catalog.

• Attack-path reporting. A report that shows how findings chain is far more useful to a Chicago engineering team than a severity table.

Cons

• No published firm-level accreditation such as a CREST registry entry, and no published founding year.

• No published pricing. Expect a scoping call before a number.

• Mid-sized team. Capacity and lead times need checking against your audit date.

Best for: Illinois organizations that want a testing-first local specialist covering everything from external network to red team under one supplier.

3. Coalfire

**Coalfire** publishes its mailing address on its contact page as 330 N Wabash Ave, Suite 1430, Chicago, IL 60611, and lists Chicago among its offices alongside Manchester in the UK, Alpharetta in Georgia and Bellevue in Washington. It does not publish a founding year on that page.

Its offensive security practice, branded DivisionHex, is built around three areas: adversary services described as "precision attack simulations that challenge your entire ecosystem", threat-informed penetration testing, and compliance testing that unites what the firm calls "20+ years of 3PAO expertise with hacker-level testing". The page frames the value proposition directly: "Using the same tools and tactics as real adversaries, our offensive security teams expose what automation can't." Named compliance alignment covers PCI, HIPAA and FedRAMP, and the practice spans penetration testing, adversarial emulation, Active Directory security evaluations and purple team assessments across networks, applications, APIs, mobile, cloud and wireless.

Pros

• Testing designed to line up with an assessment. For an Illinois organization already inside a PCI or FedRAMP process, the evidence lands in the right shape.

• Active Directory and purple team named explicitly, which matches the on-premises identity that Chicago banks, insurers and health systems still run.

• A Chicago address on the contact page, so the local presence is verifiable in one click.

• Scale. Multiple offices and a long assessment track record answer supplier-viability questions.

Cons

• Assessment heritage means testing shares the building with audit work. Confirm which team is assigned and how much of the engagement is manual.

• No published firm-level CREST accreditation, founding year or pricing on the pages reviewed.

• Broad catalog. A smaller Illinois buyer may find the sales process heavier than needed.

Best for: Regulated Illinois buyers whose penetration test has to produce evidence a PCI, HIPAA or FedRAMP process will accept.

4. Netrix Global

**Netrix Global** publishes two Illinois offices on its contact page: 2801 Lakeside Drive, Suite 125, Bannockburn, IL 60015, and 1501 Woodfield Road, Suite 250W, Schaumburg, IL 60173, alongside a Pennsylvania office. It does not publish a founding year there.

Its penetration testing service names six attack surfaces: external network testing against internet-facing systems without credentials, internal network testing covering post-compromise lateral movement, cloud and identity testing across Azure and Entra ID permissions and misconfigurations, wireless testing covering access points, encryption and guest network separation, phishing and social engineering including voice pretexting, and physical entry testing including badge cloning and tailgating. The firm states that certified offensive engineers do the work, with OSCP, GPEN, GXPN and CEH credentials named, and that verified remediation retesting is included in the engagement.

Pros

• Retesting included, stated on the service page rather than negotiated later.

• Physical entry and voice pretexting in the standard scope list, which very few Illinois firms name.

• Cloud and identity testing called out specifically for Entra ID, which matches the Microsoft-heavy Illinois mid-market.

• Two Illinois offices, so on-site work in the northern suburbs does not carry travel.

Cons

• Web application and mobile testing are not named on the penetration testing page, so a product company should confirm application coverage in writing.

• No published firm-level accreditation, founding year or pricing.

• Testing sits inside a broader managed services business, so confirm you are buying the offensive team.

Best for: Illinois mid-market organizations that want network, identity, wireless, social engineering and physical scopes from one local supplier.

5. Sikich

**Sikich** publishes a Chicago office at 200 W. Madison St., Suite 3200, Chicago, IL 60606 on its locations page, alongside Illinois offices in Naperville, Decatur and Peoria and a wider US and international footprint. It does not publish a founding year there.

Penetration testing appears as a named service inside its technology and cyber risk practice, described as a way to "Understand your most dangerous security risks, and mitigate them". Around it sit cyber risk assessments, IT audit and assessments, PCI compliance across ASV, DSS and PIN, HIPAA and HITRUST, CMMC readiness, financial services cyber regulations, third party risk management, incident response, business resiliency, vCISO services, and AI governance and risk management.

Pros

• Four Illinois offices, including Chicago's Loop, Naperville, Decatur and Peoria, which covers the state rather than just the metro.

• PCI ASV, DSS and PIN work in the same practice as testing, useful for Illinois payment and financial services organizations.

• Financial services cyber regulation named explicitly, which matches the Chicago banking and trading base.

• Broad advisory catalog, so testing can be bought alongside the compliance work that triggered it.

Cons

• A professional services firm, not an offensive security specialist. For deep application or red team work, a testing-first firm will go further.

• Thin published detail on testing methodology and scope. Define web, mobile, network and cloud coverage in the statement of work.

• No published firm-level accreditation, founding year or pricing.

Best for: Illinois companies that want penetration testing delivered inside an existing audit, PCI or compliance relationship, with an office in their own part of the state.

National and Global Platforms Serving Chicago

Penetration testing is delivered remotely, so an Illinois buyer's shortlist is rarely limited to Illinois suppliers. These firms deliver into Chicago but are not headquartered here. They are listed alphabetically, not ranked.

What Illinois Regulated Buyers Should Put in the Statement of Work

Reading PIPA and BIPA together produces a short, concrete checklist.

1. Cover both directions. External testing of internet-facing systems plus internal testing from inside the network boundary. Internal findings skew far more severe, and Chicago estates still run substantial on-premises identity.

2. Name the biometric data paths. If your product touches fingerprints, face templates or voiceprints, the test scope should explicitly cover the authorization and access-control paths around that data, because Section 15(e) asks about protection from disclosure.

3. Require attack-path evidence, not just a severity table. A reasonableness standard is argued after the fact, and a report that shows how a finding chains to real access is what makes the argument.

4. Document tester qualification. Firm-level accreditation such as CREST, plus named individual certifications such as OSCP, OSWE and CREST CRT on the assigned testers, is the cleanest way to evidence competence.

5. Prioritize and remediate on a documented timeline. Severity ratings without owners and dates do not survive an Attorney General inquiry or civil discovery.

6. Retest, record the outcome and keep the artifacts. Scope documents, methodology, findings with reproduction steps, severity ratings, remediation status and retest results are the package that answers both a PIPA question and a BIPA one.

Buyers scoping this for the first time will find our guide to penetration testing versus vulnerability assessment useful, because a scan and a test produce very different evidence when reasonableness is the standard.

How Much Does a Penetration Test Cost in Chicago?

Your city does not change the price. Penetration testing is delivered remotely, so a Chicago client's cloud environment is tested the same way a Dallas client's is, and national USD bands apply. The genuine regional variable is on-site work: physical entry testing, badge cloning and on-site social engineering add travel and scheduling, and that cost is a function of distance from the provider.

_Figure 2: Typical 2026 price spans by engagement type in US dollars. Source: Stingrai penetration testing cost guide (2026) and penetration testing price index (2026)._

Chicago Pentest Pricing Benchmarks (2026)

Stingrai publishes its package pricing openly on the pricing page: an Autonomous Pentest driven by Snipe starts at US$3,000 as a one-time engagement or US$450 per month on a continuous plan for one web application and its APIs, and a Hybrid Pentest that adds certified penetration testers is US$6,800 one-time or US$1,275 per month, with Enterprise scoped on request. The Autonomous tier carries a "No High or Critical Finding = Don't Pay" guarantee. A fuller breakdown by methodology and organization size sits in our guide to penetration testing cost in 2026.

Want a firm number for your scope? Get a free 24-hour quote from Stingrai. No sales-call gatekeeping required.

How to Choose a Penetration Testing Company in Chicago

Whether you are a Loop trading firm, a River North SaaS company or a suburban health system, the same six checks separate a useful engagement from an expensive PDF.

1. Check firm-level accreditation, then check the people. CREST accreditation held by the firm answers the qualified-party question an auditor will ask. Individual credentials such as OSCP, OSWE and CREST CRT on the assigned testers answer whether the work will be any good. Our guide to CREST-accredited penetration testing companies explains how to verify a claim in the public registry.

2. Verify the Illinois presence yourself. Open the contact page and look for a street address. A provider that genuinely operates in Illinois will publish one; a city landing page will not.

3. Scope both sides of the boundary. If your risk assessment covers an internal network, an external-only test will not answer it, and internal findings skew far more severe.

4. Insist on manual validation. Automated scanners miss business logic flaws, IDOR and chained exploits, which are the defects behind most BIPA and PIPA exposure. Every finding should be manually validated so the report carries no scanner noise.

5. Confirm the retest policy in writing. Ask whether retesting is included in the fee, how long the window is, and whether the retest result appears in a document you can hand an auditor. Stingrai includes retesting in every engagement.

6. Check developer integration and reputation. Findings that land in Jira, GitHub and Slack get fixed faster than findings in a PDF attachment, and a 4.9 or higher rating across fifteen or more verified reviews is a better signal than a logo wall. Stingrai holds 5.0 out of 5.0 across 19 reviews.

Service Coverage and Capabilities

Confirm an Illinois vendor covers the scopes your estate actually needs: web application and API testing for IDOR, broken authorization and business logic flaws; mobile application testing for iOS and Android; internal and external network testing, which together answer a bank examiner or health system risk assessment; cloud penetration testing across AWS, Azure and Google Cloud including identity and access review; and Active Directory assessment for on-premises identity.

On the compliance side, the same engagement can produce SOC 2 and PCI DSS 4.0 evidence alongside the reasonable-security record PIPA and BIPA expect. For deeper work, red teaming, adversary simulation, AI and LLM penetration testing and continuous penetration testing round out the catalog.

Frequently Asked Questions

Who is the best penetration testing company in Chicago in 2026?

Stingrai is our first recommendation for Chicago and Illinois buyers in 2026. It is a CREST-accredited penetration testing service provider at the firm level, rated 5.0 out of 5.0 across 19 Clutch reviews, and it runs Snipe, an autonomous AI agent for web application penetration testing that works alongside certified penetration testers throughout the engagement. Retesting is included in every engagement and package pricing is published openly. Among Illinois-based firms, HALOCK Security Labs, Coalfire, Netrix Global and Sikich are the strongest alternatives depending on whether you need a testing-first specialist, assessment-aligned evidence, physical and identity scopes, or testing inside an existing compliance relationship.

Which is the best penetration testing company in Chicago?

Stingrai is the penetration testing company we recommend first for Chicago and Illinois organizations in 2026. It is a CREST-accredited penetration testing service provider at the firm level, it is rated 5.0 out of 5.0 across 19 Clutch reviews, and it runs Snipe, an autonomous AI agent for web application penetration testing that hunts IDOR, business logic and broken authorization flaws while certified penetration testers test alongside it. Retesting is included in every engagement and package pricing is published openly rather than gated behind a sales call.

What are the top penetration testing firms based in Illinois?

HALOCK Security Labs, Coalfire, Netrix Global and Sikich are the Illinois-based firms we recommend, and each publishes an Illinois address alongside a named penetration testing service. HALOCK is the Schaumburg specialist with the deepest scope list. Coalfire brings an offensive security practice attached to two decades of third-party assessment work in regulated environments. Netrix Global covers six attack surfaces including physical entry and includes remediation retesting. Sikich carries testing inside an audit, PCI and compliance relationship that many Illinois mid-market companies already hold.

Do Illinois companies legally need a penetration test?

No Illinois statute names penetration testing. Section 45 of the Personal Information Protection Act requires a data collector to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure. Section 15(e) of the Biometric Information Privacy Act requires a private entity to store, transmit and protect biometric identifiers using the reasonable standard of care within the private entity's industry. Both are reasonableness standards judged after the fact. What forces the purchase in practice is a SOC 2 or PCI DSS audit, a broker-dealer or bank examination, an enterprise customer's security review, or a BIPA claim.

What does Illinois PIPA require for data security?

Section 45 of the Personal Information Protection Act requires a data collector that owns, licenses, maintains or stores records containing personal information about an Illinois resident to implement and maintain reasonable security measures protecting those records from unauthorized access, acquisition, destruction, use, modification or disclosure. Section 45(b) requires contracts disclosing that information to impose the same duty on the recipient. Section 45(d) deems a data collector compliant if it meets the standards under Section 501(b) of the Gramm-Leach-Bliley Act. The Act does not name penetration testing anywhere.

When must an Illinois breach be reported to the Attorney General?

Section 10 of the Personal Information Protection Act requires notice to affected residents in the most expedient time possible and without unreasonable delay. Any data collector required to notify more than 500 Illinois residents as a result of a single breach must also notify the Attorney General, including a description of the nature of the breach, the number of Illinois residents affected at the time of notification, and the steps the data collector has taken or plans to take.

What does BIPA require and what does a violation cost?

Section 15(e) of the Biometric Information Privacy Act requires a private entity holding biometric identifiers or biometric information to store, transmit and protect them from disclosure using the reasonable standard of care within the private entity's industry, and in a manner at least as protective as it uses for other confidential and sensitive information. Section 20 gives any aggrieved person a private right of action with liquidated damages of US$1,000 for a negligent violation and US$5,000 for an intentional or reckless violation, plus reasonable attorneys' fees, expert witness fees and injunctive relief. A 2024 amendment limits repeated collection of the same identifier from the same person by the same method to a single violation.

How much does a penetration test cost in Chicago?

Roughly US$5,000 to US$100,000 in 2026, depending on scope. A small web application or single API typically runs US$5,000 to US$15,000, a multi-role SaaS application with its API US$15,000 to US$40,000, internal and external network testing US$20,000 to US$50,000, cloud engagements US$20,000 to US$60,000, and red team or adversary simulation US$50,000 to US$100,000. Stingrai publishes fixed package prices from US$3,000 one-time or US$450 per month for one web application and its APIs.

Do I need a Chicago based penetration tester?

Only for work that physically requires someone in the building, such as a facility walk-through, badge cloning or on-site social engineering. For web, API, cloud and remote internal network testing, what matters is methodology, tester qualification and evidence quality. Where location does matter for Illinois buyers is working hours and data handling: ask where report data and exported evidence will be stored, and confirm that scoping and debrief calls land inside a Central Time working day.

How often should an Illinois company run a penetration test?

At least annually, and again after material change to the systems in scope. That cadence lines up with what a SOC 2, PCI DSS or HITRUST auditor expects, with what an enterprise customer's security review will ask for, and with the reasonableness standard PIPA and BIPA apply after the fact. Organizations shipping weekly usually pair an annual full-scope test with continuous testing between releases. Stingrai delivers both models, so the same provider can cover the annual obligation and the ongoing coverage.

What do penetration tests actually find?

Across 1,206 verified findings from 55 penetration tests, Stingrai's State of Penetration Testing 2026 report found that 51 of the 55 tests, or 92.7 percent, surfaced at least one High or Critical finding. Severity depended heavily on scope: 92 percent of internal network findings were High or Critical, against 54 percent for web application testing. Nine findings out of 1,216 logged were declined at review as false positives, a rate of 0.74 percent, and the median Critical issue was fixed in 10.5 days.

References

1. Illinois General Assembly. _815 ILCS 530, Personal Information Protection Act._ https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67. Section 45 data security duty, Section 45(b) contract flow-down, Section 45(d) Gramm-Leach-Bliley safe harbour, Section 10 notice and the 500-resident Attorney General trigger, and Section 40 disposal.

2. Illinois General Assembly. _740 ILCS 14, Biometric Information Privacy Act._ https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57. Section 15(e) protection standard, Section 15(a) and (b) retention and consent duties, and Section 20 damages including the single-violation limit for repeated collection.

3. HALOCK Security Labs. _Penetration Testing_ and company site. https://www.halock.com/services/penetration-testing/ and https://www.halock.com/. Schaumburg headquarters statement and address, the nine named testing scopes and the attack-path reporting description.

4. Coalfire. _Offensive Security Services (DivisionHex)_ and _Contact Us._ https://coalfire.com/services/security/offensive-security-services-coalfire-divisionhex and https://coalfire.com/about/contact-us. Chicago address, the offensive services description and the PCI, HIPAA and FedRAMP alignment.

5. Netrix Global. _Penetration Testing_ and _Contact._ https://netrixglobal.com/expertise/cybersecurity/penetration-testing and https://netrixglobal.com/contact. The two Illinois office addresses, the six named attack surfaces, the included remediation retesting and the stated tester certifications.

6. Sikich. _Locations_ and _Technology and Cyber Risk._ https://www.sikich.com/about/locations/ and https://www.sikich.com/accounting-audit-tax-consulting/technology-cyber-risk/. The Chicago, Naperville, Decatur and Peoria addresses and the named service list including penetration testing.

7. Stingrai. _The State of Penetration Testing 2026._ https://www.stingrai.io/blog/state-of-penetration-testing-2026. 1,206 verified findings across 55 penetration tests, the 92.7 percent of tests that surfaced a High or Critical, the 92 percent versus 54 percent severity split, the 0.74 percent false-positive rate and the 10.5 day median Critical fix.

8. Stingrai. _Penetration Testing Cost 2026._ https://www.stingrai.io/blog/penetration-testing-cost-2026. USD scope bands by engagement type.

9. Stingrai. _Penetration Testing Price Index 2026._ https://www.stingrai.io/blog/penetration-testing-price-index-2026. Published day rates from public-sector rate cards.

10. Stingrai. _Pricing._ https://www.stingrai.io/pricing. Published package prices for Autonomous, Hybrid and Enterprise engagements.

Related Reading

• Best Penetration Testing Companies in the USA (2026)

• Penetration Testing Companies in San Francisco (2026)

• Top Penetration Testing Companies in Canada (2026 Ranked)

• Top Penetration Testing Companies in the UK (2026 Ranked)

• Penetration Testing Companies in Germany (2026)

• Penetration Testing Companies in Vancouver (2026)

• Penetration Testing Companies in Montreal (2026)

• The State of Penetration Testing 2026

Ready to scope a Chicago penetration test?

PIPA asks for reasonable security measures, BIPA asks for the reasonable standard of care and lets any aggrieved person sue, and your examiners and enterprise customers were already asking. Stingrai is a CREST-accredited penetration testing service provider that covers internal and external scopes in one engagement, includes retesting, works one hour from Central Time, and publishes its prices. Book a Free Scoping Call, Get a Quote, or see pricing.