2 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
Free Penetration Testing for US Companies: How to Judge the Offers, and How Our Complimentary 2027 Pilot Works
Most offers of a free penetration test are an automated scan with a sales call attached. Ahead of our full-scale US market entry in Q1 2027, HackersHub is running 20 complimentary manual penetration tests for qualifying US companies, subject to eligibility, agreed scope and availability. This guide explains how to judge such offers, and exactly what our complimentary pilot includes.
Free penetration test or vulnerability scan?
In most cases, what is marketed as a free penetration test is an automated vulnerability scan: a tool matches your exposed services against known signatures and lists possible issues. A penetration test is a scoped manual engagement in which a qualified tester exploits and chains weaknesses to prove real impact, the distinction NIST SP 800-115 draws between identifying weaknesses and confirming them. Our guide to penetration testing versus vulnerability scanning sets out the full comparison.
Open-source tools such as OWASP ZAP and Nmap support a useful internal self-assessment, and our overview of penetration testing tools explains what they can and cannot show.
The four kinds of offer you will encounter
Offers marketed under that label fall into a small number of patterns. Knowing which one you are looking at tells you what the output can and cannot prove.
Automated scan sold as a pentest
A scanner run against your public domain, delivered as a PDF with a severity chart. Useful for hygiene, silent on business logic, access control and chained attacks. By a wide margin the most common pattern.
Teaser assessment
A short manual look at one page or one endpoint, designed to surface one or two findings that justify a paid engagement. Real expertise may be involved, but the scope is too narrow to tell you anything about your overall exposure.
Crowd or open programme
A public or private bug bounty pilot where independent researchers test your assets and are paid per valid finding. Effective for coverage over time, but there is no fixed scope, no single accountable tester and no structured report your auditor can file.
Scoped complimentary engagement
A full manual penetration test on a defined asset, under signed rules of engagement, delivered with the provider's standard report. Rare, usually limited in number and tied to a specific reason, such as a market entry or a methodology benchmark.
Red flags: how to judge a free penetration test
Before you let anyone test your systems, whatever the commercial terms, check the offer against these points. Any one of them is a reason to ask harder questions; several together mean you are looking at a scan or a lead-generation exercise.
- No written rules of engagement and no authorisation letter. Testing without documented authority can expose both sides under the Computer Fraud and Abuse Act (18 U.S.C. § 1030) and breaches most cloud and hosting terms of service.
- No named tester and no stated certifications. You should know who will test your systems and whether they hold credentials such as OSCP, OSWE or CREST.
- No defined scope. 'We will test everything' in a day or two means a scanner is doing the work.
- The sample report is a scanner export: generic descriptions, no proof-of-concept evidence, no attack narrative and severity ratings copied from a plugin rather than calculated with CVSS against your context.
- Findings are withheld or blurred until you sign a paid contract.
- No retest. A test that never verifies your fixes cannot tell you whether the risk is closed.
- Vague data handling: no statement on where evidence is stored, who can access it, how long it is kept and how it is destroyed.
- Requests for production credentials or VPN access before a contract, NDA or rules of engagement are in place.
The HackersHub US pilot: 20 complimentary penetration tests
HackersHub was founded in the Netherlands in 2015 and has completed more than 2,500 security engagements. We already serve US clients from our Netherlands-based operations together with US delivery partners, and we are planning a full-scale entry into the US market in Q1 2027. Ahead of that expansion we are offering 20 complimentary penetration tests to qualifying US companies, subject to eligibility, agreed scope and availability.
The reason is straightforward. US buyers judge a penetration testing provider on the quality of the work, and the most reliable way to show that work is to do it on a real system under real rules of engagement. The pilot is not a scan, a teaser or a reduced version of our service. It is a scoped manual engagement run by the same testers, under the same methodology and with the same deliverables as any paid HackersHub penetration test.
Our initial US focus is SaaS, fintech, healthcare technology and enterprises with complex digital infrastructure, and pilot places are allocated with that focus in mind.
Who qualifies for the pilot
Eligibility is assessed per application. Each of the 20 places is subject to agreed scope and to tester availability.
1. US headquarters or US operations
Your company is headquartered in the United States or runs material operations there, and the in-scope asset serves that business.
2. One defined in-scope asset
A single, clearly bounded target: one web application, one API, or your external network perimeter. A defined scope is what makes a manual test meaningful; we agree it with you in writing before any testing starts.
3. A named technical contact
Someone on your side who can answer scoping questions, provision test accounts, whitelist source addresses where needed and receive critical findings immediately during the engagement.
4. Rules of engagement and an authorisation letter
You agree to our rules of engagement (testing windows, out-of-scope systems, escalation contacts, data handling) and sign an authorisation letter confirming you have the authority to permit testing of the asset. Where the asset runs on third-party hosting or cloud infrastructure, you confirm the provider's testing policy allows it.
The head-to-head benchmark option
Many US companies that apply already work with a penetration testing provider and want to know how that work holds up. For them the pilot includes a head-to-head benchmark option. We test the same asset, against a comparable scope, that your current provider tested most recently, and you compare the two reports side by side.
The comparison is yours to make, and we suggest you make it on substance: which findings each report contains, whether each finding comes with reproducible evidence, whether severities were calculated for your environment, whether the attack narrative explains how an adversary would move from the first weakness to the data that matters, and whether the remediation advice is specific enough for your engineers to act on. If the reports agree, you have independent confirmation of your current provider's work, which is a useful outcome in its own right.
Standard pilot and head-to-head benchmark compared
Both pilot variants are full manual engagements. The difference lies in how the scope is set and what you do with the result.
| Aspect | Standard pilot | Head-to-head benchmark |
|---|---|---|
| Intended for | Companies without a current provider, or testing a new asset | Companies that already use a penetration testing provider |
| Scope | One web app, API or external perimeter, agreed in writing | The asset your current provider tested most recently, against a comparable scope |
| Input from you | Asset details, test accounts, testing window | The same, plus the version tested before and what has changed since |
| Testers | OSCP-certified testers, named in the report | OSCP-certified testers, named in the report |
| Report | Executive summary, CVSS-scored findings with evidence, attack narrative, prioritised remediation | The same report, ready to set beside your current provider's |
| Retest | Verification retest of medium and higher findings within 90 days | Verification retest of medium and higher findings within 90 days |
What you receive
A pilot engagement delivers exactly what a paid HackersHub penetration test delivers. Nothing is held back for a later upgrade.
- A scoping session and a written scope statement covering the asset, test type, testing window and exclusions
- Manual testing by OSCP-certified testers, with OSWE and CREST-certified specialists on the team, aligned with PTES, the OWASP Web Security Testing Guide and NIST SP 800-115
- Immediate notification of any critical finding during the engagement, through your named technical contact
- An executive summary written for leadership and the board, in plain business terms
- CVSS-scored findings, each with reproduction steps and evidence such as requests, responses and screenshots
- An attack narrative describing how findings combine into realistic attack paths
- Prioritised remediation guidance your engineering team can act on directly
- A verification retest of medium and higher findings within 90 days, with an updated report showing what is closed
How to apply, and what happens next
Apply through our contact page and tell us three things: where your company is headquartered or operates in the US, which asset you would like tested, and whether you want the head-to-head benchmark option. We reply with a short scoping questionnaire and, if the application fits, a scoping call with one of our lead testers.
After scoping you receive the rules of engagement and the authorisation letter for signature. Testing starts in an agreed window once both are signed and access is in place. Because the engagement is delivered remotely from the Netherlands, we agree testing windows that suit your US time zone and your change calendar, and we coordinate any source-address whitelisting in advance.
If your application does not qualify, or the 20 places have been allocated, we will say so plainly. You can still scope a standard engagement through our penetration testing services page, and our guides on choosing a provider and on reading a penetration testing report will help you judge any offer you receive.
Frequently asked questions
Related reading
- Penetration testing services by HackersHub
- Penetration testing vs vulnerability scanning
- Penetration testing tools: what they can and cannot show
- How to choose a penetration testing company
- What a good penetration testing report contains
- Penetration testing in the United States
- HackersHub announces US expansion for 2027
Apply for one of 20 complimentary US penetration tests
Tell us where you operate in the US and which asset you want tested. We will confirm eligibility, scope the engagement with a lead tester and agree the rules of engagement before any testing begins. Places are subject to eligibility, agreed scope and availability.