Attacker entry points
The test checks how an attacker could get into your systems.
FunctionOne penetration testing
FunctionOne penetration testing shows how attackers could get in
FunctionOne penetration testing checks how an attacker could get into your systems, and we scope it separately from our monitoring work. Results feed vulnerability management, which tracks the weaknesses that need fixing. Leadership gets the findings with owners and next steps. FunctionOne has run managed IT and cybersecurity since 1992 from offices in Syracuse, New York and Tampa, Florida.
Book a security assessment
We'll review your systems and accounts, then agree scope and response rules with you before anything is switched on.
We use your details only to arrange your assessment.
What does FunctionOne penetration testing include?
FunctionOne penetration testing covers how an attacker could get in and what happens to the findings afterward.
Scope apart from monitoring
We scope penetration testing separately from monitoring. Our security analysts watch connected systems 24/7 as a separate service.
Security assessment first
Work with FunctionOne starts with a security assessment. We review systems and accounts, then agree scope and response rules before anything is switched on.
Vulnerability management
Test results feed vulnerability management, which tracks weaknesses that need fixing.
Findings with owners
We report findings to leadership with owners and next steps. Your team knows who's fixing what.
Regular leadership updates
Leadership gets a monthly summary and a regular security review.
Managed or co-managed IT
FunctionOne runs fully managed IT or works co-managed beside an in-house IT team.
Why do leaders need FunctionOne penetration testing?
NIST's Technical Guide to Information Security Testing and Assessment (SP 800-115), published in 2008, says assessors in a penetration test mimic the attacks organizations face to find ways around security features. In the planning phase, that 2008 NIST guide says rules are identified, management approval is finalized and documented, and goals are set. FunctionOne scopes penetration testing separately from monitoring.
CISA's Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments, published in 2024, found valid accounts were the most common successful attack technique, and assessors' most successful attacks used phishing, valid accounts and default credentials. That analysis covers federal, critical infrastructure and some state and local assessments. A penetration test checks how an attacker could get in, and we feed the results into vulnerability management.
New York State Department of Financial Services rules in 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies (2023), require covered firms to run penetration testing from inside and outside their systems at least annually, by a qualified internal or external party. Those rules apply to DFS-regulated financial firms, such as banks and insurers. FunctionOne reports findings to leadership with owners and next steps, so leaders who answer to a board, insurer or auditor can see who owns each fix.
How does FunctionOne run a penetration test?
A FunctionOne penetration test starts with a review of your systems and ends with a report to your leadership.
Security assessment first
FunctionOne reviews your systems and accounts in a security assessment. All clients start here, before anything is switched on.
Agree the scope
We agree the test's scope with you as a separate piece of work from monitoring. NIST's SP 800-115 (2008) puts rules, management approval and goals in the planning phase.
Test the ways in
The test checks how an attacker could get into your systems within the agreed scope.
Track what needs fixing
Results feed vulnerability management, which tracks weaknesses that need fixing.
Report to leadership
FunctionOne reports findings to your leadership with owners and next steps.
How is a FunctionOne penetration test different from monitoring?
FunctionOne scopes penetration testing separately from monitoring, and the two do different jobs.
| Penetration testing | 24/7 security monitoring |
|---|---|
| Checks how an attacker could get in | Security analysts watch connected systems 24/7 |
| Scoped as a separate piece of work | Switched on after scope and response rules are agreed |
| Findings go to leadership with owners and next steps | Leadership gets a monthly summary and a regular security review |
Who needs penetration testing from FunctionOne?
FunctionOne works with established mid-size and large organizations that have outgrown a help desk.
Leaders who report upward
Owners and executives who answer to a board, insurer, auditor or parent company get findings with owners and next steps.
IT directors with teams
FunctionOne can work co-managed beside your in-house IT team. Test results feed vulnerability management, so your staff can see which weaknesses need fixing.
What do leaders ask FunctionOne about penetration testing?
What does a penetration test check?
A FunctionOne penetration test checks how an attacker could get into your systems. NIST's Technical Guide to Information Security Testing and Assessment (SP 800-115, 2008) describes assessors copying attackers' methods to find ways around security features. Results then feed vulnerability management.
How is a penetration test scoped?
FunctionOne scopes penetration testing separately from monitoring. We start with a security assessment of your systems and accounts, then agree the test's scope and response rules with you before anything is switched on.
Is penetration testing the same as security monitoring?
No, FunctionOne scopes them separately. A penetration test checks how an attacker could get in. Monitoring means security analysts watch connected systems 24/7 and contain threats only within response rules you approve. Both feed reports to leadership with owners and next steps.
What happens after the penetration test?
FunctionOne reports findings to your leadership with owners and next steps. Results also feed vulnerability management, which tracks weaknesses that need fixing. Your leadership gets a monthly summary and a regular security review.
How often should a business get a penetration test?
Outside guidance points to regular testing, and FunctionOne scopes each test with you. CISA's Cross-Sector Cybersecurity Performance Goals 2.0 (2025) call for penetration tests by third-party experts. New York's Department of Financial Services (23 NYCRR Part 500, 2023) requires covered firms to test at least annually.
What do attackers use most often to get in?
Valid accounts were the most common successful technique, at 41% of successful attempts, in CISA's Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments (2024), which covers federal, critical infrastructure and some state and local assessments. FunctionOne testing checks how an attacker could get in.
Does FunctionOne offer penetration testing in Syracuse and Tampa?
Yes, FunctionOne serves clients from offices in Syracuse, New York, at 6216 Thompson Road, and Tampa, Florida, at 401 East Jackson Street. We've provided managed IT and cybersecurity since 1992. Both offices share the phone number 315-437-6714 for now.
Sources
- NIST, Technical Guide to Information Security Testing and Assessment (SP 800-115), 2008
- CISA, Cross-Sector Cybersecurity Performance Goals 2.0, 2025
- CISA, Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments, 2024
- New York State Department of Financial Services, 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies, 2023