Penetration Testing Companies in New York (2026 Ranked)

The penetration testing companies we recommend for New York buyers in 2026 are Stingrai, Kroll, Trail of Bits, IBM X-Force Red and Include Security. Stingrai ranks first: it is a CREST-accredited penetration testing service provider at the firm level, rated 5.0 out of 5.0 across 19 Clutch reviews, and it runs Snipe, an autonomous AI agent for web application penetration testing that works alongside its human penetration testers on every engagement. Kroll is the pick for regulated financial institutions that want a New York headquartered firm with CREST accreditation, Trail of Bits for cryptography and low-level systems review, IBM X-Force Red for enterprise programs, and Include Security for boutique application assessments out of Brooklyn.

New York is the most expensive place in the world to get breached and the most closely supervised place in the United States to be tested. The average American data breach now costs US$11.5 million, more than double the global average of US$4.99 million, per the IBM Cost of a Data Breach Report 2026. On top of that cost sits a regulator that writes penetration testing into a rule and fines companies when the program behind it fails.

Below is a ranking of the firms serving New York's banks, insurers, fintechs and SaaS companies, analyzed by verified New York presence, testing methodology, independent accreditation, fit with 23 NYCRR Part 500, remediation support and pricing transparency. We also include 2026 USD pricing benchmarks and a buyer's checklist.

New York Penetration Testing Companies at a Glance (2026)

Best Pentest Companies in New York: Quick Answers

Which is the best penetration testing company in New York?

Stingrai is the penetration testing company we recommend first for New York organizations in 2026. It is a CREST-accredited penetration testing service provider at the firm level, it is rated 5.0 out of 5.0 across 19 Clutch reviews, and it runs Snipe, an autonomous AI agent for web application penetration testing that hunts IDOR, business logic and broken authorization flaws while certified human penetration testers test alongside it. Retesting is included in every engagement and package pricing is published openly rather than gated behind a sales call.

What are the top penetration testing firms in New York City?

The top penetration testing firms for New York City buyers split by scenario: Stingrai for AI-augmented manual testing on one-time or continuous engagements, Kroll for regulated financial institutions that want a New York headquartered firm with CREST accreditation, Trail of Bits for cryptography, blockchain and compiler-level review, IBM X-Force Red for enterprise programs across a large estate, and Include Security for deep boutique application assessments.

Do New York companies legally need a penetration test?

Companies licensed by the New York State Department of Financial Services do. Section 500.5(a)(1) of 23 NYCRR Part 500 expects covered entities to conduct penetration testing of their information systems from both inside and outside the information systems' boundaries, by a qualified internal or external party, at least annually. Companies outside DFS supervision still face the New York SHIELD Act's reasonable safeguards standard, plus whatever their auditors and enterprise customers demand.

Why New York Pentest Demand Is Rising in 2026

New York organizations buy penetration testing for three reasons that stack on top of each other: a regulator that names the control, a concentration of financial services targets, and the highest breach costs in the world.

The regulator names the control

The New York State Department of Financial Services supervises any individual or organization operating under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law. That sweeps in state-chartered banks, insurers, mortgage servicers, money transmitters and virtual currency businesses, which in practice means most of the financial firms with a New York footprint.

The Second Amendment to 23 NYCRR Part 500 took effect on November 1, 2023 and rewrote Section 500.5 as a vulnerability management obligation. The operative language is precise. Covered entities must conduct, at a minimum, "penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually", plus automated scans and a manual review of systems not covered by those scans, at a frequency set by the risk assessment and promptly after any material system change.

Three details in that sentence decide what you buy. First, both inside and outside means an external test alone does not satisfy the requirement; you need internal network testing as well. Second, qualified puts the burden on you to show the tester was competent, which is why firm-level accreditation and named tester credentials matter in a DFS examination. Third, at least annually is a floor, not a ceiling, and a company shipping code weekly will struggle to argue that one test a year reflects its risk assessment.

The amendment also phased in the rest of the rule. Covered entities had 180 days from November 1, 2023 for most new requirements, one year for the governance and training provisions in sections 500.4, 500.15, 500.16 and 500.19(a), 18 months for the scanning duty in 500.5(a)(2), and two years, to November 1, 2025, for multi-factor authentication under section 500.12 and the asset inventory under section 500.13(a). The transition period is over. Everything in Part 500 is now live.

A "class A company" carries extra weight. Part 500 defines one as a covered entity with at least US$20 million in gross annual revenue in each of the last two fiscal years from its own and its New York affiliates' operations, plus either more than 2,000 employees averaged over two years or more than US$1 billion in gross annual revenue. Class A companies must design and conduct independent audits of the cybersecurity program, monitor privileged access activity, and deploy privileged access management and endpoint detection and response.

The regulator enforces it

Part 500 is not a paper rule. In 2025 the department announced nine civil penalties under it.

_Figure 1: Civil penalties announced under 23 NYCRR Part 500 in 2025. Source: New York State Department of Financial Services press releases, January 23, 2025 and October 14, 2025._

On January 23, 2025 the department secured a US$2 million settlement with PayPal after unauthorized parties reached IRS Forms 1099-K containing unredacted names, dates of birth and full Social Security numbers through credential stuffing. The department cited failures to use qualified personnel for key cybersecurity functions, to train staff adequately, and to maintain written policies covering access controls and identity management.

On October 14, 2025 the department secured more than US$19 million from eight auto insurers whose online quoting applications and agent portals leaked driver's license numbers and dates of birth. Hartford Fire paid US$3 million, Farmers Insurance Exchange US$2.775 million, Liberty Mutual US$2.7 million, State Automobile Mutual US$2.5 million, Infinity US$2.25 million, Metromile US$2.05 million, Midvale Indemnity US$2 million and Hagerty US$1.85 million. Two of them, Farmers and Infinity, were also cited for failing to report the incidents promptly.

The common thread is instructive for anyone scoping a test. None of these were exotic exploits. They were authorization and access-control failures in customer-facing web applications, exactly the class of bug that automated scanning tends to miss and that a competent application penetration test is designed to find.

The target concentration is unique

New York City's securities industry employed 198,200 people in 2025, close to the thirty-year high of 201,500 set in 2024, and produced US$65.1 billion in profits, according to the New York State Comptroller. The comptroller estimates one in every thirteen jobs in the city is directly or indirectly tied to the industry. Layer the city's fintech and B2B SaaS population on top, and New York holds a density of high-value, heavily regulated, internet-facing applications that no other US metro matches.

That concentration shows up in what testing finds. Stingrai's own State of Penetration Testing 2026 report, built on 1,206 verified findings across 55 penetration tests, found that 67.2% of findings were rated High or Critical and that authentication and session handling was the single largest vulnerability class in web application testing at 28.1%. For a New York fintech, that is the profile of a DFS consent order waiting to happen.

Quick Comparison: Best Pentest Firms in New York

How We Ranked These Companies

Every firm in this guide had to clear three eligibility gates. It must productize penetration testing as a primary service rather than as a side practice. It must have a verifiable New York connection, meaning a New York headquarters, a published New York office, or a stated ability to deliver to New York buyers. And its core claims must be verifiable on its own website or in a public registry.

Ranking then weighed six criteria:

1. Verified New York presence, confirmed from the firm's own site or a public filing rather than a directory listing.

2. Independent accreditation and tester credentials on the people who run the engagement, weighted above logo walls.

3. Testing methodology, specifically manual depth and how automation is used alongside it.

4. Fit with 23 NYCRR Part 500, including whether the firm can cover both the internal and external halves of Section 500.5(a)(1).

5. Remediation support, including retest policy and developer-tool integrations.

6. Pricing transparency in US dollars.

Vendor facts in this guide, including headquarters addresses, accreditations, audit counts and platform claims, were verified in August 2026 against each provider's own website or a public registry. Claims that could not be reached on at least one verification pass against a named primary source were dropped rather than estimated. Regulatory language is quoted from the text of the Second Amendment to 23 NYCRR Part 500 as published by the department.

1. Stingrai (Top Rated for New York Buyers)

Stingrai is ranked the best penetration testing company for New York buyers in 2026 for organizations that need testing evidence a DFS examiner or an enterprise security review will accept. Founded in 2021 and headquartered in Toronto, it serves New York clients remotely across the full working day in Eastern time, on both one-time annual engagements and continuous PTaaS programs.

The thing that separates Stingrai from a conventional consultancy is how the engagement is staffed. Snipe, Stingrai's autonomous AI agent for web application penetration testing, runs throughout the test alongside certified human penetration testers rather than before or after them. Snipe is built to hunt the classes that generic AI tooling misses: IDOR, business logic flaws and broken authorization. It performs black-box dynamic testing and white-box source review, generates AutoFix pull requests for what it finds, and can run as a pull-request gating check that blocks vulnerable code from merging. The human testers direct where Snipe looks, extend the attack paths it opens, and pursue what it surfaces, and both contribute findings across every severity.

For a New York fintech, that combination maps neatly onto the pattern in the department's own enforcement record. The failures that drew penalties in 2025 were authorization and access-control defects in customer-facing applications, which is precisely the territory Snipe was built for.

At a Glance

Why Stingrai Ranks First for New York

• Both halves of Section 500.5(a)(1) in one engagement. The rule expects testing from inside and outside the information systems' boundaries. Stingrai scopes internal and external network testing alongside web application testing, so one report covers the whole obligation instead of two disconnected projects.

• Firm-level CREST accreditation. A DFS examiner asking whether the tester was "qualified" gets a registry-backed answer, not a resume.

• Snipe hunts the bugs New York regulators actually fine people for. Broken authorization, IDOR and business logic flaws in customer-facing applications are the recurring theme in Part 500 consent orders, and they are what Snipe was purpose-built to find.

• Annual and continuous, not one or the other. A New York SaaS company shipping weekly can run a continuous program; an insurer that needs a clean annual report can buy a single scoped engagement. Both are standard.

• Retesting is included. Fixes get verified inside the same engagement rather than becoming a separate purchase order, which matters when an auditor wants remediation evidence and not just a finding list.

• Published pricing. Package prices sit on the pricing page instead of behind a discovery call, which shortens procurement for a security team working against an audit date.

Pros

• Every finding is manually validated, so the report that reaches your auditor does not carry scanner noise.

• Retesting is included in every engagement rather than sold separately.

• Findings push directly into Jira, GitHub and Slack, so remediation happens where developers already work.

• Package pricing is transparent, which makes budget approval faster in a regulated organization.

Cons

• Newer brand than the Big Four, which matters to buyers who weigh name recognition over technical depth.

• Headquartered outside the United States. Contracts that require US-person testers, such as work touching Controlled Unclassified Information, need that delivery-team restriction written in during scoping.

• No New York office, so buyers who insist on testers physically on site in Manhattan should raise that during scoping.

Best for: New York fintech, SaaS and financial services organizations that need Part 500 aligned internal and external testing from a CREST-accredited firm, delivered as either a one-time annual test or a continuous program.

Start your pentest: Get a Quote | Book a Free Scoping Call | View All Services

2. Kroll

**Kroll** is headquartered at One World Trade Center, 285 Fulton Street, and states that it employs 6,500 experts across more than 30 countries and territories. Its cyber risk practice sits inside a firm whose core business is financial and risk advisory to exactly the institutions Part 500 covers, which is the reason it belongs high on a New York shortlist.

On credentials, the CREST Marketplace listing for Kroll LLC shows accreditation for Penetration Testing, Incident Response and Security Operations Centre, with coverage across North America, Europe and Asia Pacific, and records eight years of CREST membership plus ISO 27001 certification.

Pros

• Registry-verified accreditation. CREST accreditation for penetration testing is checkable in a public marketplace listing, which is the kind of evidence that survives an examination.

• Financial services fluency. Kroll's advisory work sits in the same regulatory world as its testing clients, so scoping conversations rarely need translation.

• Incident response adjacency. The same firm that tests you can be retained for response, which some boards prefer.

Cons

• Advisory-led pricing and process. Engagements are scoped and quoted through a consulting motion, which is slower than a fixed-price package for a small application scope.

• Breadth over specialization. A large practice spanning testing, response and operations means tester seniority varies more across engagements than at a small specialist shop.

Best for: New York banks, insurers and asset managers that want a locally headquartered firm with registry-verified penetration testing accreditation.

3. Trail of Bits

**Trail of Bits** has worked out of 228 Park Avenue South in Manhattan since 2012, and it is the New York firm to call when the problem is hard rather than broad. It states that it has completed more than 620 public audits and published roughly 945 research pieces, and its practice areas run to cryptography, blockchain, AI and machine learning security, and security engineering alongside conventional application review.

For New York specifically, two things stand out. The cryptography practice, described as PhD-level cryptographers who build and break real protocols, is directly relevant to the payments and trading infrastructure clustered downtown. And the blockchain practice, which reviews every layer from smart contracts to nodes and bridges, matters to the digital asset businesses that DFS licenses under its virtual currency regime.

Pros

• Depth on problems most firms decline. Cryptographic protocol review, compiler and low-level systems work, and blockchain infrastructure audits sit outside the range of a general pentest shop.

• Public research record. The audit and publication counts are stated openly and the reports themselves are largely public, so you can read the work before you buy it.

• Manhattan presence. On-site collaboration is straightforward for a downtown or midtown engineering team.

Cons

• Not a compliance-testing vendor. If your requirement is a scoped annual internal and external network test to satisfy Section 500.5(a)(1), this is not where that work naturally sits.

• Engineering-led engagements. The model suits organizations with strong internal security engineering; a company buying its first penetration test will get more out of a firm that packages the exercise.

Best for: New York digital asset, payments and infrastructure companies that need cryptographic, blockchain or low-level systems review from a Manhattan-based research firm.

4. IBM X-Force Red

IBM is headquartered at 1 New Orchard Road in Armonk, New York, as stated in its annual report on Form 10-K, and its offensive security team is X-Force Red. The service covers penetration testing, vulnerability management and adversary simulation across applications, networks, cloud assets, AI models, mainframes, hardware and personnel, and it is sold three ways: as individual projects, as a subscription, or as a managed testing program.

For a New York enterprise, the draw is coverage rather than boutique depth. A large bank running mainframes alongside cloud-native applications and a growing set of AI systems can put all of that in one testing relationship, which is administratively simpler than assembling three specialists.

Pros

• Estate-wide scope. Mainframe, hardware and AI model testing are unusual in one vendor, and all three matter to legacy-heavy New York financial institutions.

• Flexible commercial models. Project, subscription and managed program options let a program grow without renegotiating from scratch.

• Procurement familiarity. Most large New York enterprises already have IBM on paper, which removes a vendor onboarding cycle.

Cons

• Enterprise-scale engagement. Small and mid-market buyers will find the scoping and procurement heavier than the test itself warrants.

• Delivery is global, not local. The New York connection is corporate rather than a dedicated New York testing team, so confirm where your testers sit if that matters to you.

Best for: Large New York enterprises consolidating application, network, cloud, mainframe and AI testing into a single managed program.

5. Include Security

**Include Security** is headquartered in Brooklyn and describes serving "NYC, SF, and the world" from there. Its distinguishing practice is staffing: it states that assessments are staffed by area of expertise rather than by geography or availability, and that every consultant has at least five years of application hacking experience. That is a direct answer to the most common complaint about large testing firms, which is that the person who scoped the work is not the person who performs it.

Its assessment range covers web applications, mobile applications, web services, server and client applications, IoT devices, software reverse engineering, fuzzing and exploit development, with clients spanning consumer technology, healthcare and automotive.

Pros

• Senior-only staffing model. The five-year floor on application hacking experience is stated publicly and is unusual to commit to in writing.

• Source-assisted assessments. Working with code alongside the running application finds authorization and business logic defects that black-box testing alone misses.

• Local and boutique. A Brooklyn headquarters and a small team make direct access to the tester straightforward.

Cons

• Application focus over compliance coverage. Network-wide testing to satisfy the internal half of Section 500.5(a)(1) is not the practice's center of gravity.

• Limited public firm-level accreditation. Credentials sit with individual consultants rather than in a public firm registry, which is a harder answer to give an examiner.

• Capacity. A boutique bench means lead times can be longer than a platform vendor's when you are testing against an audit date.

Best for: New York product companies that want a deep, source-assisted application assessment from senior consultants rather than a compliance deliverable.

6. The Big Four (KPMG, Deloitte, EY, PwC)

All four of the Big Four run their US firms out of Manhattan. KPMG's US headquarters is at Two Manhattan West, and Deloitte's US national office is at 30 Rockefeller Plaza. PwC's US firm is registered at 300 Madison Avenue and EY's Americas operations are at One Manhattan West. Each offers cybersecurity consulting that includes penetration testing, usually as one workstream inside a larger risk or audit relationship.

Pros

• Board and regulator fluency. When a testing program has to be explained to an audit committee or a supervisor, the Big Four speak that language natively.

• Bundling. Testing can be folded into an existing audit or transformation contract, which simplifies procurement.

• Global program management. Useful for a New York headquartered institution with subsidiaries under several regulators.

Cons

• Cost per unit of testing. Equivalent scopes cost substantially more than at a specialist firm, because you are also buying the consulting wrapper.

• Generalist delivery teams. The people running the test are more often consultants than dedicated offensive security researchers.

• Slower cycles. Scoping, staffing and reporting timelines are built for large programs, not for a team that ships weekly.

Best for: Fortune 500 institutions headquartered in New York where penetration testing is a line item inside a much larger audit or transformation contract.

Other Firms New York Buyers Shortlist

The six above cover most New York buying scenarios. Several other US firms are credible on the right scope and deliver to New York clients, though none of them is headquartered in the state.

What 23 NYCRR Part 500 Expects From a Penetration Test

Reading Section 500.5 as a purchasing specification produces a short, concrete checklist. Use it when you write the statement of work.

1. Cover both directions. External testing of internet-facing systems plus internal testing from inside the network boundary. A scope that only covers the perimeter does not meet the requirement.

2. Document tester qualification. Section 500.5(a)(1) says a qualified internal or external party. Firm-level accreditation such as CREST, plus named individual certifications on the assigned testers, is the cleanest way to evidence that.

3. Run it at least annually, and more often if your risk assessment says so. The rule sets a floor. If you deploy continuously, a once-a-year test is difficult to defend as proportionate.

4. Keep the scanning duty separate. Section 500.5(a)(2) requires automated scans plus manual review of systems the scans do not cover, at a frequency set by the risk assessment and promptly after material system changes. A penetration test does not discharge that obligation.

5. Prioritize and remediate on a documented timeline. The Second Amendment added an explicit expectation that vulnerabilities are remediated in a timely manner, prioritized by the risk they pose.

6. Retest and record the outcome. An examiner asking about a Critical finding from last year's report wants evidence it was fixed and verified, not just that it was reported.

7. Keep the artifacts. Scope documents, methodology, findings with reproduction steps, severity ratings, remediation status and retest results are the package that answers a Part 500 question.

Buyers scoping this for the first time will find our guide to penetration testing versus vulnerability assessment useful, because Section 500.5 requires both and treats them as different obligations.

How Much Does a Penetration Test Cost in New York?

Penetration testing is priced by scope, not by zip code. A New York buyer pays what a Chicago or Austin buyer pays for the same number of endpoints, roles and hosts. What differs is that New York scopes tend to be larger, because the applications are more complex and the compliance requirements pull more systems into the boundary.

_Figure 2: Typical 2026 fee ranges by engagement scope. Source: Stingrai 2026 scoping benchmarks for United States engagements._

New York Pentest Pricing Benchmarks (2026)

Big Four firms typically quote well above these ranges for equivalent scopes, because the testing is bundled into broader consulting. Stingrai publishes its package pricing openly on the pricing page: an Autonomous Pentest driven by Snipe starts at US$3,000 as a one-time engagement or US$450 per month on a continuous plan for one web application and its APIs, and a Hybrid Pentest that adds certified human penetration testers is US$6,800 one-time or US$1,275 per month, with Enterprise scoped on request. A fuller breakdown by methodology, mandate and organization size sits in our guide to penetration testing cost in 2026.

Want a firm number for your scope? Get a free 24-hour quote from Stingrai. No sales-call gatekeeping required.

How to Choose a Penetration Testing Company in New York

Whether you are a Midtown insurer, a Flatiron SaaS company or a downtown trading firm, the same seven checks separate a useful engagement from an expensive PDF.

1. Check firm-level accreditation, then check the people. CREST accreditation held by the firm answers the "qualified party" question in Section 500.5(a)(1). Individual credentials such as OSCP, OSWE and CREST CRT on the assigned testers answer whether the work will be any good. Ask for tester bios before signing. See our guide to CREST-accredited penetration testing companies for how to verify a claim in the public registry.

2. Scope both sides of the boundary. If you are a DFS covered entity, an external-only test leaves half the requirement unmet. Confirm internal network testing is in the statement of work.

3. Insist on manual validation. Automated scanners miss business logic flaws, IDOR and chained exploits. Those are the defects behind the department's 2025 consent orders. Every finding should be manually validated so the report your auditor reads carries no scanner noise.

4. Confirm the retest policy in writing. Ask whether retesting is included in the fee, how long the window is, and whether the retest result appears in a document you can hand an examiner. Stingrai includes retesting in every engagement.

5. Match the report to your audience. A Part 500 examiner, a SOC 2 auditor and a customer security review all want different framing of the same findings. Ask to see a redacted sample report before you sign.

6. Check developer integration. Findings that land in Jira, GitHub and Slack get fixed faster than findings that live in a PDF attachment. Median remediation time is the metric that actually reduces your risk window.

7. Verify reputation independently. Look for a 4.9 or higher rating across fifteen or more reviews on a platform that verifies the reviewer, such as Clutch. Stingrai holds 5.0 out of 5.0 across 19 reviews.

Fintech and payments buyers weighing the same factors should also read our ranking of the best penetration testing companies for fintech, which scores vendors on PCI DSS 4.0.1, SOC 2 and DORA fit.

Service Coverage and Capabilities

When evaluating a New York vendor, confirm they cover the specific testing services your estate requires.

Core penetration testing services

• **Web Application Penetration Testing**: SQL injection, cross-site scripting, IDOR and business logic flaws in SaaS and customer portals.

• Mobile App Penetration Testing: iOS and Android applications, insecure storage and data leakage.

• **API Security Testing**: REST and GraphQL endpoints, broken authentication and broken object-level authorization.

• **Network Penetration Testing**: external and internal infrastructure, which together satisfy Section 500.5(a)(1).

• Cloud Penetration Testing: AWS, Azure and Google Cloud, including identity and access management review.

Regulator-driven assessments

• NYDFS Part 500 testing: internal and external penetration testing scoped to Section 500.5(a)(1), with retest evidence.

• **SOC 2 Penetration Testing**: the standard evidence US auditors expect for SOC 2 Type II.

• **PCI DSS 4.0 Penetration Testing**: required under Requirement 11.4 for merchants and service providers.

• **HIPAA Security Assessment**: for New York health technology companies handling patient data.

Advanced offensive security

• **Red Teaming**: full-scope simulations of a real adversary against your detection stack.

• **Adversary Simulation**: threat-actor emulation aligned to the groups targeting financial services.

• **Continuous Penetration Testing**: ongoing assessment for teams shipping weekly.

Buyers comparing markets can also read our United States ranking, the Toronto guide, and the global ranking.

Frequently Asked Questions

Who is the best penetration testing company in New York in 2026?

Stingrai is our first recommendation for New York buyers in 2026. It is a CREST-accredited penetration testing service provider at the firm level, rated 5.0 out of 5.0 across 19 Clutch reviews, and it runs Snipe, an autonomous AI agent for web application penetration testing that works alongside certified human penetration testers throughout the engagement. Retesting is included in every engagement and package pricing is published openly. Kroll, Trail of Bits, IBM X-Force Red and Include Security are the strong alternatives depending on whether you need a New York headquarters, deep cryptographic research, enterprise breadth or a boutique application assessment.

Does NYDFS require penetration testing?

Yes, for covered entities. Section 500.5(a)(1) of 23 NYCRR Part 500 expects covered entities to conduct penetration testing of their information systems from both inside and outside the information systems' boundaries, by a qualified internal or external party, at least annually. Section 500.5(a)(2) separately requires automated scans plus a manual review of systems the scans do not cover, at a frequency set by the risk assessment and promptly after material system changes. The current text is published by the New York State Department of Financial Services.

How much does a penetration test cost in New York?

A small web application or single API typically runs US$5,000 to US$15,000, a mid-size SaaS or mobile application US$15,000 to US$40,000, internal and external network testing US$20,000 to US$50,000, and cloud engagements US$20,000 to US$60,000. Red team and adversary simulation runs US$50,000 to US$100,000, and an annual continuous program runs US$25,000 to US$100,000. Stingrai publishes fixed package prices starting at US$3,000 one-time or US$450 per month on its pricing page.

What happens if a New York company fails to comply with Part 500?

The department brings civil enforcement actions and imposes penalties through consent orders. In 2025 it announced nine of them: a US$2 million settlement with PayPal in January, and more than US$19 million from eight auto insurers in October, ranging from US$1.85 million to US$3 million each. The cited failures were consistently basic: unqualified personnel in key cybersecurity roles, missing written policies for access control and identity management, weak controls on customer-facing web applications, and in two cases late incident reporting.

Which New York penetration testing companies hold CREST accreditation?

Among the firms in this guide, Kroll LLC holds CREST accreditation for Penetration Testing, Incident Response and Security Operations Centre, verifiable in the CREST Marketplace. Stingrai Inc is a CREST-accredited Penetration Testing service provider at the firm level and serves New York clients remotely. Firm-level accreditation is distinct from individual CREST CRT certifications held by testers, and both are worth asking about.

What is a class A company under 23 NYCRR Part 500?

A class A company is a covered entity with at least US$20 million in gross annual revenue in each of the last two fiscal years from its own operations and its affiliates' New York operations, plus either more than 2,000 employees averaged over the last two fiscal years or more than US$1 billion in gross annual revenue in each of the last two fiscal years across all affiliates. Class A companies carry extra obligations including independent audits of the cybersecurity program, privileged access monitoring, a privileged access management solution and endpoint detection and response.

Do I need a New York based penetration tester?

For nearly all commercial and DFS work, no. Section 500.5(a)(1) asks for a qualified internal or external party and says nothing about location, and SOC 2, PCI DSS 4.0, HIPAA and ISO 27001 all care about methodology and evidence quality rather than the tester's address. Location becomes a real constraint only for contracts touching Controlled Unclassified Information under DFARS 252.204-7012 or ITAR-controlled technical data, where US-person testing restrictions commonly apply and must be written into the agreement before kickoff.

How often should a New York fintech run a penetration test?

At least annually to meet the Section 500.5(a)(1) floor, and more often if your risk assessment or release cadence warrants it. A company deploying weekly has a hard time arguing that one test a year is proportionate to its risk. Most New York fintechs settle on an annual full-scope test plus continuous testing between releases. Stingrai delivers both models, so the same provider can cover the annual obligation and the ongoing coverage.

What do penetration tests actually find?

Across 1,206 verified findings from 55 penetration tests, Stingrai's State of Penetration Testing 2026 report found that 67.2% were rated High or Critical. In web application testing specifically, authentication and session handling was the largest class at 28.1%, followed by misconfiguration and hardening at 14.2% and information disclosure at 12.5%. That distribution lines up closely with the failures the department cited in its 2025 enforcement actions.

Does the New York SHIELD Act require penetration testing?

Not by name. New York General Business Law section 899-bb, added by the SHIELD Act and effective March 21, 2020, requires any person or business holding computerized private information of a New York resident to develop, implement and maintain reasonable administrative, technical and physical safeguards. Penetration testing is one of the standard ways an organization demonstrates that its technical safeguards work, but the statute sets a reasonableness standard rather than naming a specific control.

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is automated pattern matching against known issues and produces a list of candidates. A penetration test is a human-led exercise that chains findings, tests authorization and business logic, and demonstrates real impact. Part 500 treats them as separate obligations: Section 500.5(a)(1) covers penetration testing, Section 500.5(a)(2) covers scanning plus manual review of what scans do not reach. Buying one does not discharge the other.

References

1. New York State Department of Financial Services. _Second Amendment to 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies._ Effective November 1, 2023. https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf. The operative regulatory text, including the rewritten Section 500.5 vulnerability management obligation, the class A company definition and the transitional periods.

2. New York State Department of Financial Services. _Cybersecurity Resource Center._ https://www.dfs.ny.gov/cybersecurity. Guidance, FAQs and filing resources for covered entities.

3. New York State Department of Financial Services. _Superintendent Adrienne A. Harris Secures $2 Million Cybersecurity Settlement with PayPal, Inc._ January 23, 2025. https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20250123. Consent order over unredacted tax-form data reached via credential stuffing.

4. New York State Department of Financial Services. _Superintendent Harris Secures More than $19 Million from Eight Auto Insurers._ October 14, 2025. https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20251014. Eight consent orders over data exposed through online quoting applications and agent portals.

5. IBM. _Cost of a Data Breach Report 2026._ https://www.ibm.com/reports/data-breach. Global average of US$4.99 million and a United States average of US$11.5 million.

6. Office of the New York State Comptroller. _DiNapoli: $246,900 Average Bonus on Wall Street, Up 6 Percent in 2025._ March 2026. https://www.osc.ny.gov/press/releases/2026/03/dinapoli-246900-average-bonus-on-wall-street-up-6-percent-in-2025. Securities industry employment, profits and the industry's share of New York City economic activity.

7. CREST. _Kroll LLC supplier listing._ https://marketplace.crest.org/supplier/kroll-llc/. Registry record of accreditation for Penetration Testing, Incident Response and Security Operations Centre.

8. Kroll. _About Us._ https://www.kroll.com/en/about-us. Headquarters address at One World Trade Center, 6,500 experts and coverage in more than 30 countries.

9. Trail of Bits. _About._ https://www.trailofbits.com/about/. Founding in 2012, service lines, and the stated counts of public audits and research publications.

10. Trail of Bits. _Contact._ https://www.trailofbits.com/contact/. New York, NY address at 228 Park Avenue South.

11. IBM. _X-Force Red offensive security services._ https://www.ibm.com/services/offensive-security. Service scope across applications, networks, cloud, hardware and AI, and the project, subscription and managed delivery models.

12. International Business Machines Corporation. _Annual Report on Form 10-K, fiscal year 2025._ https://www.sec.gov/Archives/edgar/data/51143/000005114326000010/ibm-20251231.htm. Corporate headquarters in Armonk, New York.

13. Include Security. _Home._ https://includesecurity.com/. Brooklyn headquarters, assessment scope, and the stated staffing model and experience floor.

14. KPMG. _New York: making bold moves at Two Manhattan West._ https://kpmg.com/us/en/how-we-work/locations/new-york.html. US headquarters location.

15. Deloitte. _Deloitte New York, National Office._ https://www.deloitte.com/us/en/offices/us-locations/national-office.html. US national office at 30 Rockefeller Plaza.

16. Stingrai. _The State of Penetration Testing 2026._ https://www.stingrai.io/blog/state-of-penetration-testing-2026. Analysis of 1,206 verified findings across 55 penetration tests, including severity distribution and class mix by test type.

17. Stingrai. _Pricing._ https://www.stingrai.io/pricing. Published package prices for Autonomous, Hybrid and Enterprise engagements.

Related Reading

• Top Penetration Testing Companies in the USA (2026 Ranked)

• Penetration Testing Companies in Toronto (2026)

• Best Penetration Testing Companies (2026, Global Ranking)

• Best Penetration Testing Companies for Fintech (2026)

• CREST-Accredited Penetration Testing Companies (2026)

• The State of Penetration Testing 2026

• Penetration Testing Cost in 2026

• Penetration Testing vs. Vulnerability Assessment: What Compliance Actually Requires

Ready to scope a New York penetration test?

Part 500 asks for testing from inside and outside your boundary, by a qualified party, at least once a year. Stingrai is a CREST-accredited penetration testing service provider that covers both halves in one engagement, includes retesting, and publishes its prices. Book a Free Scoping Call or Get a Quote.