# Halo Security > Halo Security provides expert manual penetration testing by US-based security professionals. Services cover web and mobile applications, APIs, external and internal networks, wireless environments, social engineering, and red teaming. Engagements include direct access to the testing team, audit-ready reports, remediation guidance, and one round of retesting. Halo Security helps organizations uncover exploitable vulnerabilities, business logic flaws, and attack paths through hands-on testing tailored to their systems and security objectives. Customers can start with a standalone penetration test, with a fixed-price quote based on an initial scoping conversation. Deliverables include a penetration testing report with findings, supporting evidence, business impact, and practical remediation steps, plus an attestation letter describing the engagement and scope. After remediation, an included round of retesting verifies fixes and produces an updated report. Testing and reporting support SOC 2, HIPAA, PCI DSS, and customer security reviews, with scope and evidence needs agreed during scoping. Halo Security also provides External Attack Surface Management (EASM), continuous vulnerability scanning, and PCI Approved Scanning Vendor (ASV) services to complement manual testing with ongoing discovery and monitoring. ## Penetration Testing Overview - [Penetration Testing](https://www.halosecurity.com/penetration-testing/): Primary overview of manual testing services, the testing team, scoping, pricing, methodology, deliverables, remediation support, and included retesting. - [Contact](https://www.halosecurity.com/contact): Discuss testing scope, security objectives, and reporting needs with the Halo Security team. ## Penetration Testing Services - [Web Application Penetration Testing](https://www.halosecurity.com/penetration-testing/web-application): Manual testing for business logic flaws, authentication bypasses, and complex application vulnerabilities. - [API Penetration Testing](https://www.halosecurity.com/penetration-testing/api): Testing of REST, GraphQL, and SOAP APIs for authentication weaknesses, authorization flaws, and data exposure risks. - [Mobile Application Penetration Testing](https://www.halosecurity.com/penetration-testing/mobile-application): iOS and Android testing for insecure data storage, communication flaws, and platform-specific vulnerabilities. - [External Network Penetration Testing](https://www.halosecurity.com/penetration-testing/external-network): Manual assessment of internet-facing infrastructure for exploitable vulnerabilities and perimeter misconfigurations. - [Internal Network Penetration Testing](https://www.halosecurity.com/penetration-testing/internal-network): Assumed-breach testing for lateral movement, privilege escalation, and access to critical internal systems. - [Wireless Penetration Testing](https://www.halosecurity.com/penetration-testing/wireless): Assessment of Wi-Fi infrastructure for encryption weaknesses, rogue access points, and authentication bypasses. - [Compliance Penetration Testing](https://www.halosecurity.com/penetration-testing/compliance): Testing scoped to compliance and audit needs, including internal, external, and segmentation testing for PCI DSS environments. - [Social Engineering Testing](https://www.halosecurity.com/penetration-testing/social-engineering): Targeted phishing and social engineering campaigns to assess employee awareness and human security controls. - [Red Teaming](https://www.halosecurity.com/penetration-testing/red-teaming): Adversarial simulations to evaluate detection, incident response, and security controls under realistic attack conditions. ## Penetration Testing Resources - [DCM Case Study](https://www.halosecurity.com/resources/case-study-dcm): How Data Communications Management uses Halo Security for penetration testing, PCI ASV scanning, and remediation guidance. - [10 Lessons from 300 Web Application Penetration Tests](https://www.halosecurity.com/landing/ebook-ten-lessons-pentesting): Practical lessons from Halo Security's VP of Security Nick Merritt. - [A Practical Guide to Planning Your Next Penetration Test](https://blog.halosecurity.com/a-practical-guide-to-planning-your-next-penetration-test-in-2025/): Practitioner guidance on scoping and budgeting a pentest. - [Resource Hub](https://www.halosecurity.com/resources/): Guides, case studies, webinars, and reference material. - [Blog](https://blog.halosecurity.com): Security research, threat advisories, and practitioner guidance. ## Complementary Security Solutions - [Attack Surface Management](https://www.halosecurity.com/attack-surface-management): Continuous discovery, inventory, and monitoring of internet-facing assets to complement scoped penetration tests. - [External Vulnerability Management](https://www.halosecurity.com/external-vulnerability-management): Continuous external vulnerability scanning with risk-based prioritization. - [PCI ASV Scanning](https://www.halosecurity.com/pci-compliance/): PCI DSS Approved Scanning Vendor services for external vulnerability scanning. - [Our Approach](https://www.halosecurity.com/approach): Methodology and philosophy behind Halo Security's EASM platform. ## Supporting Platform Capabilities - [Discovery Scanning](https://www.halosecurity.com/discovery-scanning): Agentless, continuous asset discovery. - [Website Scanning](https://www.halosecurity.com/website-scanning): Monitoring of web-facing assets for client-side and content risks. - [Server Scanning](https://www.halosecurity.com/server-scanning): Vulnerability scanning of server infrastructure. - [Application Scanning](https://www.halosecurity.com/application-scanning): Application-layer vulnerability detection. - [Technology Scanning](https://www.halosecurity.com/technology-scanning): Identifies software and technologies in use for CVE matching. - [Firewall Scanning](https://www.halosecurity.com/firewall-scanning): Tests externally exposed firewall configurations. - [Dark Web Monitoring](https://www.halosecurity.com/dark-web-monitoring): Monitors for exposed credentials and data. - [Integrations](https://www.halosecurity.com/integrations/): Connects Halo Security with existing security tooling. ## Attack Surface Management Use Cases - [Inventory Your Attack Surface](https://www.halosecurity.com/inventory-attack-surface) - [Monitor Subsidiary Risk](https://www.halosecurity.com/monitor-subsidiaries) - [Evaluate Mergers & Acquisitions](https://www.halosecurity.com/evaluate-mergers-acquisitions) - [Assess Security Program Effectiveness](https://www.halosecurity.com/assess-security-program-effectiveness) - [Prevent Subdomain Takeovers](https://www.halosecurity.com/prevent-subdomain-takeovers) ## Company - [About Us](https://www.halosecurity.com/company/): Company background, founded 2013, woman-owned, user-funded. - [Customers](https://www.halosecurity.com/customers): Customer list and case material. ## Optional - [Trust Center](https://trust.halosecurity.com): Security and compliance documentation. - [Documentation](https://docs.halosecurity.com): Product documentation. - [Attack Surface Management Demo](https://meet.halosecurity.com/attack-surface-management-demo) - [Attack Surface Management Free Trial](https://meet.halosecurity.com/free-asm-trial) - [Attack Surface Management 101](https://blog.halosecurity.com/attack-surface-management-101-everything-you-need-to-know-about-the-latest-approach-to-external-security/): Foundational explainer on EASM and external security. - [Why external vulnerability scanning is no longer sufficient on its own](https://blog.halosecurity.com/why-external-vulnerability-scanning-is-no-longer-sufficient-on-its-own/): Positioning on the limits of scanning alone. - [Free Site Scan Tool](https://www.sitescan.com): Free external scanning tool.