As our company is growing in size we've decided its time for a PenTest. We'd like to do several pentests. One on our actual stie hosted off site on a dedicated provider. One of our internal office network and one physical pen-test.
Does anyone have recommendations as to solid independent companies that can provide the pentests described above? We'd like them them to probe and prove vulnerabilities and see if they can compromise systems and then provide a thorough debrief with recommendations for mitigation.
The physical pen-test is secondary but we believe strongly that social engineering is a heavy risk and want to mitigate for it. We feel an actual test on our office will be a strong wake up call to our users but want to make sure we use a known reputable company.
If anyone has advice to provide as to how we should better structure the pentests or goals to aim for that'd be appreciated as well.