Does Stingrai have an office in New York?

No. Stingrai serves New York organizations remotely from its Toronto head office, which is in the same Eastern time zone, and its London office. Most web application, API, cloud and external network testing runs remotely, and on-site work such as physical security assessments and Wi-Fi assessments is scheduled in New York where the scope requires it.

What does NYDFS Part 500 require for penetration testing?

Section 500.5(a)(1) of 23 NYCRR Part 500 requires covered entities to conduct penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually. Section 500.5(a)(2) adds automated scans and a manual review of systems the scans do not cover. Covered entities that qualify for the limited exemption in section 500.19(a) are exempt from section 500.5.

Do New York hospitals need annual penetration testing?

Yes. 10 NYCRR 405.46 applies to general hospitals licensed under Article 28 of the Public Health Law and requires penetration testing of the hospital's information systems by a qualified internal or external party at least annually, based upon the hospital's risk assessment. The regulation took effect on October 2, 2024 with one year to comply, and records pertaining to systems design, security and maintenance must be kept for at least six years.

Does the New York SHIELD Act require penetration testing?

The SHIELD Act, General Business Law section 899-bb, requires reasonable safeguards for the private information of New York residents and does not name penetration testing. Its technical safeguards include a program that regularly tests and monitors the effectiveness of key controls, systems and procedures, and an independent penetration test is one way to evidence that testing.

How long does a penetration test take?

A single-tenant web application with two roles and fewer than thirty endpoints takes a few tester days across one to two weeks. A multi-tenant product with four to six roles and a few hundred endpoints takes two to four weeks. The Autonomous Pentest by Snipe returns same-day results, and continuous programs deliver findings as they are confirmed.

Is Stingrai CREST-accredited?

Yes. Stingrai Inc. holds CREST accreditation for penetration testing at the firm level and is listed on the CREST marketplace. Individual penetration testers on the team separately hold CREST CRT.

Penetration Testing Services in New York City

CREST-accredited testing for New York financial services, insurance, healthcare and SaaS organizations, delivered remotely from Stingrai's Toronto head office in the same time zone.

CREST-accredited testing for New York organizations

Stingrai provides penetration testing services in New York City for web applications, APIs, mobile apps, cloud, internal and external networks, Active Directory and AI systems, plus red teaming and social engineering. Founded in Toronto in 2021, the firm holds CREST accreditation for penetration testing and is rated 5.0 on Clutch across 20 reviews.

Every human-led engagement is staffed by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, and is reviewed by the team lead and an engagement partner. The team has published 18 CVEs, and its researchers are listed in the bug bounty Halls of Fame of Apple, Google, Facebook and the US Department of Defense.

Testing is delivered remotely from the Toronto head office, which shares New York's Eastern time zone, with on-site work such as physical security and Wi-Fi assessments scheduled where the scope requires it. Findings are posted to the PTaaS portal as they are confirmed, and retesting of fixed findings is included.

Penetration testing services for New York organizations

Human-led and hybrid testing across applications, infrastructure and people, scoped to what the business, its regulators and its customers need.

Web application penetration testing

Find the business logic, broken authorization and IDOR flaws that scanners miss, tested across every user role.

API penetration testing

Confirm that every endpoint enforces authentication, authorization and input handling for each role and tenant.

Mobile application penetration testing

Secure iOS and Android apps and their backend APIs with static and dynamic analysis aligned to OWASP MASVS.

Cloud penetration testing

Close the IAM, cross-account trust and storage policy gaps in AWS, Azure and Entra ID, and Google Cloud.

Internal and external network testing

See which perimeter exposures, lateral movement paths and segmentation gaps an attacker could use.

Active Directory security assessment

Trace the misconfigurations, ACL abuse and Kerberos delegation paths that lead to domain admin.

Red teaming

Measure detection and response against assumed breach, full-chain and threat intelligence-led scenarios.

Social engineering

Learn how staff and facilities respond to phishing, vishing and on-site physical security assessments.

AI and LLM penetration testing

Test LLM apps, AI agents and their tools for prompt injection, jailbreaks and excessive agency.

Evidence for New York and US compliance programs

Stingrai's reports and retest evidence support the examinations, audits and customer security reviews that New York financial services, insurance, healthcare and SaaS organizations face.

NYDFS 23 NYCRR 500.5: Penetration testing of information systems from both inside and outside their boundaries by a qualified internal or external party, at least annually, as section 500.5(a)(1) requires.
New York SHIELD Act: Evidence for the reasonable safeguards General Business Law section 899-bb requires, including regular testing and monitoring of the effectiveness of key controls, systems and procedures.
10 NYCRR 405.46 (general hospitals): Penetration testing of the hospital's information systems by a qualified internal or external party at least annually, based upon the hospital's risk assessment.
HIPAA Security Rule: Technical evaluation evidence for the periodic evaluation standard at 45 CFR 164.308(a)(8) and the risk analysis behind it.
SOC 2: Independent penetration test reports and retest evidence for SOC 2 audits and the customer security reviews that follow.
PCI DSS 4.0, Requirement 11.4: Internal and external penetration testing, including segmentation testing, as Requirement 11.4 sets out.
ISO/IEC 27001: Technical vulnerability testing evidence for an information security management system and its surveillance audits.
Vendor risk and enterprise procurement: Independent test reports for the vendor risk questionnaires that New York banks, insurers and enterprises send to their suppliers.

Trusted by Security Teams Globally

Rigorous, genuinely hands-on pentest partner that behaves like part of your team. The technical depth is well beyond what we expected at this price point, and they traced issues to specific code paths.

Elia R., Mesh ID (G2 review)

Simplifies the pentesting process by giving us one place to request, manage, and track security testing. We spent WAY less time coordinating and more time improving security.

Riley D., Frontend Developer, TPH (G2 review)

Published pricing for web application testing

Fixed prices for one web application and associated APIs, tested by Snipe alone or by Snipe with Stingrai's penetration testers. Retests are included. All prices are in USD.

Fully autonomous web application pentest powered by Snipe.

Deliverables: Pentest Report
Scope & Depth: One web application and associated APIs
Cadence: One-time autonomous testing by Snipe

Up to 200 API endpoints or dynamic pages
Up to 3 user roles for authenticated testing
Same-day results
OWASP Top 10
Business logic & authorization flaws
Black, white, or grey-box testing
Automated retests
AutoFix PRs

or book a 30-minute discovery call

How an engagement runs

Human-led and Hybrid engagements follow the same path from scoping to verified fixes, managed through Stingrai's PTaaS platform.

Scoping call

A 30-minute discovery call reviews the applications, networks, compliance requirements and deadlines in scope. Pricing for larger scopes follows through the Get a Quote form within 24 hours.

Statement of work and access

The scope, testing window and rules of engagement are confirmed in a statement of work, with test accounts for each user role and any VPN or repository access.

Testing window

Two named penetration testers test the agreed scope, reviewed by the team lead and an engagement partner, with live chat open throughout. On Hybrid engagements, Snipe tests alongside them.

Findings as they are confirmed

Each finding is posted to the PTaaS portal with a working proof of concept and prioritized remediation guidance, ready to push to Jira or Slack, so fixing starts before the report.

Report

An executive summary for leadership and a full technical report for engineering, delivered as redactable PDFs to share with customers and auditors.

Retest and attestation

Retesting of remediated findings is included. Hybrid and human-led engagements also receive an attestation letter for customers and auditors.

Penetration testing in New York: FAQs

Stingrai publishes fixed prices for one web application and associated APIs. The Autonomous Pentest by Snipe is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest, Snipe with Stingrai's penetration testers, is US$6,800 per assessment or US$1,275 per month. Larger scopes, such as several applications, networks, cloud environments or red teaming, are quoted through the Get a Quote form within 24 hours.

Find the Gaps Before Real Adversaries Do.

Book a 30-minute discovery call to scope the test, or submit the Get a Quote form for pricing within 24 hours.