Penetration testing in San Antonio: the complete SMB guide.

A penetration test is a human adversary, hired by you. An operator takes the same access a real attacker would have — the public internet, a phished credential, a foothold on one workstation — and chains real weaknesses into demonstrated access to your systems and data, then documents exactly how, with proof. A vulnerability scan, by contrast, is software producing a list of potential issues, most of which were never exploitable and some of which hide the one path that is. Scans are a hygiene tool; a penetration test is evidence. Auditors, regulators, insurers, and courts treat the two completely differently — and so do attackers. If a quote arrives within minutes, prices like a subscription, or promises “unlimited pentesting,” you are being sold a scan. We wrote more on this in why vulnerability scanners are dying.

External network testing attacks what the internet can see — your perimeter, VPNs, mail, and exposed services. Internal testing assumes one workstation is compromised and measures how far an attacker gets: usually the most sobering report a business ever reads. Web application and API testing targets the software your customers touch, from authentication logic to injection paths. Cloud testing hunts IAM over-privilege, exposed storage, and misconfiguration across M365, AWS, Azure, and GCP. AI & LLM testing red-teams the models and agents you’ve deployed against prompt injection, data leakage, and tool abuse — the OWASP LLM Top 10, proven, not theorized (see securing AI’s new attack surface). Social engineering tests your people — phishing, vishing, pretexting. And red team operations combine all of it into a stealth campaign against your detection and response, not just your prevention. Full details on our services page.

Honest market ranges — every firm scopes differently, but for a typical SMB engagement in this market you should expect:

Scope drives everything: number of external hosts, internal subnets, applications, and whether social engineering or physical access is in play. Two warnings from inside the industry: a price dramatically below these ranges buys a rebranded scan, and a price quoted without a scoping call buys a template. A real firm asks questions before it quotes.

Texas gives San Antonio businesses one of the clearest legal reasons in the country to test: SB 2610, the cybersecurity safe harbor, took effect September 1, 2025, shielding businesses under 250 employees from punitive damages after a breach — but only if they can prove a documented, framework-aligned program existed beforehand (basic controls under 20 employees, CIS Controls IG1 at 20–99, NIST CSF or ISO 27001 at 100–249). In Military City, one framework towers over the rest: CMMC is non-negotiable for the enormous base of DoD suppliers around Joint Base San Antonio and Port San Antonio. Add the TDPSA (enforced by the Texas AG, up to $7,500 per violation), HIPAA for the South Texas Medical Center, and PCI-DSS and GLBA for the USAA-anchored financial-services base, and a documented penetration test is simply the cost of doing business here. Read our full SB 2610 safe harbor guide.

They call it Military City USA, and the cyber footprint backs it up: Joint Base San Antonio, the 16th Air Force (Air Forces Cyber), and the NSA’s Texas Cryptologic Center have seeded one of the densest clusters of defense and cybersecurity contractors in the nation, anchored by Port San Antonio. Around it sits USAA and a deep financial-services base, the South Texas Medical Center with its hospital and bioscience networks, and a fast-growing manufacturing and tourism economy. A contractor base this close to national-security work inherits serious obligations — and every supplier downstream is a target. The breach paths we exploit most here: phished credentials and MFA fatigue against M365, unsegmented networks bridging IT and OT, and under-scoped vendor connections into regulated environments.

More on how we operate locally: 0x3 Security — San Antonio.

Five filters separate operators from resellers. Ask who does the work — names and certifications of the actual testers (look for hands-on-keyboard certs like OSCP, CRTO, CPTS, PNPT, earned by exploitation, not multiple choice). Ask for a sanitized sample report — if it’s a scanner export with a logo, walk. Ask how findings are proven — real firms deliver reproduction steps and proof-of-concept, not CVSS scores copy-pasted from a database. Ask what happens after the report — remediation guidance and a retest to verify fixes should be included, not upsold. And ask about scoping — a firm that quotes without understanding your environment is pricing a template, not your risk. We’re happy to be held to all five: meet the team.

A real deliverable has four layers. An executive summary in plain language your leadership and clients can read — what an attacker could do to the business, not jargon. Technical findings, each with severity, reproduction steps, and proof-of-concept evidence. A prioritized remediation roadmap — what to fix first and why, scoped to your team or MSP. And a retest verifying the fixes actually closed the paths. That document then earns its keep for years: it’s the evidence your auditor requests, the artifact your cyber insurer prices against, the attachment that closes enterprise deals, and — under the legal frameworks above — part of your defense file.

For most San Antonio SMBs, a scoped external penetration test runs roughly $5,000–$15,000, internal or web-application testing $8,000–$25,000, and full red team operations start around $25,000. Anyone quoting a few hundred dollars is selling an automated scan, not a penetration test.

Not directly — but SB 2610 makes documented security testing the price of the safe harbor. For San Antonio’s large base of DoD suppliers, CMMC goes further and makes assessment mandatory. A dated third-party pentest report is among the strongest evidence for both.

A scan is software listing potential weaknesses, many of them false positives. A penetration test is a human operator exploiting those weaknesses the way a real attacker would — chaining them into actual access and proving business impact. Compliance frameworks and courts treat them very differently.

Annually at minimum, plus after major changes — new offices, mergers, cloud migrations, or new customer-facing applications. PCI-DSS requires testing at least annually and after significant changes; HIPAA and CMMC expect regular technical evaluation.

Most SMB engagements run one to three weeks from kickoff to report, depending on scope. Red team operations run longer — typically four to eight weeks — because stealth and persistence are part of the objective.