2 November 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
Penetration Testing for MSPs: Why Your Clients Are Asking, What to Test and How to Deliver It Without Building a Red Team
Managed service providers now field the penetration testing question from two directions: clients whose insurer, auditor or customer demands a test, and attackers who have learned that one MSP is a door to a hundred networks. This guide covers both. What an MSP should test on its own stack, what to offer clients, and the four ways to deliver it, from referral to building an in-house team.
Two meanings of MSP penetration testing
Penetration testing for MSPs means two different things, and a provider needs an answer for both. The first is testing the MSP itself: the remote monitoring and management platform, the identity tenant with delegated access to every client, the backup infrastructure, the remote-support tools and the documentation vault that holds client credentials. The second is offering penetration testing to clients, either as a service line the MSP delivers or as something it arranges through a specialist partner. The first protects the business; the second grows it and, increasingly, is a condition of keeping clients who are being asked for test reports by third parties.
An MSP is not an MSSP. A managed service provider runs IT: endpoints, networks, identity, backup, help desk. A managed security service provider runs security operations: monitoring, detection, response. Many MSPs sell security services without being an MSSP, and penetration testing sits outside both, because the party that builds and runs an environment is, by definition, not independent of it. Our MSP versus MSSP guide and our explainer on what an MSSP does, both linked below, draw the line in detail. This page is about the testing question.
Why MSP clients now ask for penetration tests
Five years ago a small or mid-sized business rarely asked its MSP for a penetration test. Today the request usually arrives with a form attached. These are the drivers, and each one tells the MSP what the report has to satisfy.
Cyber insurance applications and renewals
Insurer questionnaires ask about MFA, EDR, immutable backups and whether an independent penetration test was performed in the last twelve months. A 'no' raises the premium or the deductible, or triggers an exclusion; a 'yes' has to be backed by a report when a claim is made.
Compliance frameworks that reach small businesses
PCI DSS v4.0.1 Requirement 11.4 for anyone taking cards, the HIPAA Security Rule's periodic technical evaluation at 164.308(a)(8) for covered entities and business associates, SOC 2 for anyone selling software, the FTC Safeguards Rule's annual test (16 CFR 314.4(d)(2)) for car dealers that finance, mortgage brokers and other non-bank lenders, and CMMC 2.0 Level 2 for defence subcontractors, where the MSP itself is in scope as an external service provider.
Customer and supply-chain due diligence
Enterprise customers push security questionnaires down to their suppliers. A manufacturer, law firm or logistics company with forty staff is asked for a current penetration test by a customer with forty thousand, and turns to its MSP.
After an incident or a near miss
A ransomware event at a peer, a business email compromise that nearly paid out, or an insurer's post-claim conditions. The client wants to know what else is open, and wants someone other than the MSP to say so.
Mergers, financing and board pressure
Acquirers and lenders ask for cyber diligence; boards of mid-market companies have read the headlines. A test report is the document that answers both.
The MSP as an attack path
Attackers worked out the economics before most MSPs did: compromise one provider and inherit privileged access to every client. From 2019 onward, ransomware groups abused MSP remote management tools to push encryption to dozens of downstream businesses at once, and in July 2021 a flaw in an on-premises RMM server product was used to deploy ransomware to roughly 1,500 organisations through their providers in a single weekend. In May 2022, CISA and its Five Eyes partners issued a joint advisory on protecting MSPs and their customers, which set out expectations that insurers and enterprise customers have since written into their questionnaires. In February 2024, an authentication-bypass flaw in a widely used remote-support product was added to CISA's Known Exploited Vulnerabilities catalogue within days of disclosure, with MSP instances among the first targets.
The pattern in every case is the same: the attacker does not need to breach the client, only the tool the client has already trusted. That is why an MSP's own penetration test matters more than any single client's, why clients' auditors increasingly ask who tests the provider, and why a provider that offers testing to clients should be able to show its own report first.
What an MSP should test on its own stack
Six components where a finding at the MSP becomes a finding at every client. Described at control level; the test establishes whether each control holds under a determined attacker.
RMM and automation platform
Who can log in, with what second factor, from where; how scripts and policies are approved before they run on client endpoints; whether a technician account or an API key can push to every tenant; and how the platform's own patch level is managed.
Identity and delegated administration
The MSP's own Microsoft 365 and Entra ID tenant, its granular delegated admin privileges into client tenants, conditional access on technician accounts, privileged access workstations, and the offboarding of former technicians, which is where stale access accumulates.
Backup infrastructure
Separate credentials from production identity, immutability or logical air gap, whether a compromised RMM session can reach the backup console, and whether client restores have actually been tested rather than assumed.
Remote access and support tools
VPN concentrators, screen-sharing and remote-support products, jump hosts and the exposure of their management interfaces to the internet. These are the products most often found in the exploited-vulnerabilities catalogue.
PSA, documentation and credential vault
The ticketing system and the documentation platform together hold every client's network diagram, admin password and recovery key. Access control, MFA, export controls and audit logging on these systems are tested as if they were a client's crown jewels, because they are.
Email tenant and technician workstations
Phishing resistance of staff who hold privileged access everywhere, the path from one compromised mailbox to an RMM or vault session, endpoint hardening on technician machines, and the detection record of what the MSP's own tooling saw during the test.
What to offer clients
A client-facing testing offer for small and mid-sized organisations does not need a catalogue. It needs the five engagements that answer insurers, auditors and customers, and a clear statement of what each one is not.
- External penetration test of the internet-facing perimeter, VPN and remote access, and published applications: the test most insurance and vendor questionnaires are asking about
- Internal assumed-breach test from a standard user workstation, covering Active Directory or Entra ID, privilege paths, segmentation and what ransomware would reach: the test that reflects how incidents actually happen
- Microsoft 365 and identity configuration review, often combined with the internal test, because most small-business incidents start in the mailbox
- Web application or API test for clients that build or run customer-facing software, scoped against OWASP WSTG and the API Security Top 10
- Phishing simulation and social engineering testing of staff with payment or administrative privileges, linked to the client's awareness training
- Continuous vulnerability scanning as the hygiene layer between tests, sold honestly as scanning and never presented as a penetration test
- A verification retest after remediation, so the client has closure evidence to give the insurer or auditor
Four ways to deliver penetration testing: refer, white-label, co-deliver or build
Each model trades control for effort and independence. The independence column matters more than most MSPs expect: PCI DSS 11.4.1 and most auditors require the tester to be organisationally independent of the people who run the environment, which an MSP testing its own managed clients cannot claim.
| Aspect | Refer to a specialist | Resell or white-label | Co-deliver | Build in-house |
|---|---|---|---|---|
| Who owns the client relationship | Specialist, with MSP introduction | MSP; specialist invisible or named as subcontractor | MSP, with specialist present | MSP |
| Who performs the test | Specialist's certified testers | Specialist's certified testers | Specialist tests; MSP handles scoping, logistics and remediation | MSP's own hires |
| Independence for auditors and PCI DSS 11.4.1 | Full | Full, if the report names the independent testers | Full for the testing; MSP remediation stays separate | None for the MSP's own managed clients |
| Report branding | Specialist's | MSP's or co-branded, testers still named | Co-branded | MSP's |
| Liability and insurance | Specialist's professional indemnity | Shared; contract defines responsibility | Shared; contract defines responsibility | MSP's, including errors and omissions on testing |
| Time to first engagement | Days | Weeks: contract, pricing model, process | Weeks | Twelve months or more: hiring, certification, tooling, methodology |
| Fits when | Occasional requests, compliance-driven clients | Steady demand, MSP wants a security line without the headcount | MSP has a security practice and wants to learn the craft alongside | Large MSP with a separate security business unit and a non-managed client base |
Scoping a penetration test for small and mid-sized clients
A fifty-person client does not need an enterprise programme. It needs the right four or five days of testing on the systems where its money and its data live, scheduled so the MSP can act on the result.
Start with the money and the identity
Scope the perimeter, remote access, the Microsoft 365 tenant and an assumed-breach internal test from one workstation before anything else. These four cover how the large majority of small-business incidents begin and end.
Scope from the client's obligations, not from the asset list
If the driver is PCI DSS, the cardholder data environment and its segmentation must be in scope. If it is HIPAA, systems handling protected health information. If it is an insurer, read the questionnaire and scope to answer it.
Group scheduling across clients
MSPs with several clients due in the same quarter can schedule testing windows back to back, with one scoping call per client and a shared logistics process. The reports stay separate and client-specific.
Agree the rules of engagement with the MSP in the room
The MSP knows the environment, holds the credentials and runs the detection tooling. It joins the scoping call, provides the test workstation and the VPN, and receives critical findings during the test rather than at the end.
Never substitute a scan report
A vulnerability scan exported from the MSP's own tooling is not a penetration test and will not survive an auditor, an insurer's claims adjuster or a customer's security team. Sell scanning as scanning.
Reporting an MSP can act on
The report has to work for three readers at once: the client's owner, the client's insurer or auditor, and the MSP engineers who will fix the findings.
- An executive summary in business terms for the client's leadership, without acronyms, stating what an attacker could have reached and what to do first
- Findings mapped to the controls the MSP actually manages (identity, endpoint, patching, backup, firewall, email), so each one becomes a ticket with an owner
- CVSS v4 severity plus a plain-language likelihood and impact, with reproducible evidence the MSP can verify
- A remediation plan ordered by risk reduction per hour of MSP effort, which is how a small client's budget is actually spent
- A scope statement and methodology section the insurer or auditor can file without further questions
- A detection record showing what the MSP's monitoring saw and when, which doubles as a tuning list for the MSP's own tooling
- A retest letter once the fixes are in, written so it can be forwarded to the insurer, auditor or customer as closure evidence
Questions MSPs ask before partnering on penetration testing
The questions below come up in almost every first conversation with an MSP. Ask them of any testing partner, including us.
- Who actually performs the test, what certifications do they hold, and will they be named in the report
- Is the test manual, or an automated scan with a human-written summary
- Can the report carry our brand or be co-branded, and will the testers still be named so the client's auditor accepts it
- How is scoping handled for a client with thirty users and one server, and how is pricing structured (per scope, per day, per client)
- What happens when a critical finding appears mid-test: who is told, how quickly, and does the client hear it from us
- Can several clients be scheduled together, and how is confidentiality kept between their reports
- Is a retest included, and within what window
- Does the partner carry professional indemnity insurance that covers testing activity, and what does the contract say about damage during a test
- Will the partner sell to our client directly afterwards, and is that written down
How HackersHub works with MSPs
HackersHub works with managed service providers as the hands-on testing partner for their clients. The provider keeps the client relationship; we scope, test and report. Engagements can be referred, resold or delivered white-label on request, with our testers named in the report so the client's auditor, insurer or customer accepts it as independent. We also test MSPs' own stacks, which is often where the relationship starts. Every tester holds OSCP at minimum, with OSWE and CREST-certified testers on the team; methodology follows PTES, OWASP WSTG and MASTG and NIST SP 800-115; and a verification retest of medium and higher findings within 90 days is included in every engagement.
Reports are written for the MSP's engineers as much as for the client's leadership: findings mapped to the controls you manage, a remediation order that respects a small client's budget, and a retest letter the client can forward. HackersHub is based in Amsterdam, Netherlands and tests US clients remotely within agreed windows and US business hours, with on-site days where an internal engagement needs them. With 10+ years of offensive security work and a 4.9/5 rating across 127 reviews, we are comfortable being the testers behind someone else's client relationship.
Frequently asked questions
Related guides
- Penetration testing services by HackersHub
- MSP vs MSSP: what is the difference?
- What is an MSSP and what does it do?
- Penetration testing as a service: continuous testing explained
- What a penetration testing report should contain
- Third-party penetration testing and tester independence
- Penetration test vs vulnerability scan
- Phishing simulation for your clients' staff
- Penetration testing for banks and credit unions
Clients asking you for a penetration test?
Keep the relationship, add the capability. We scope, test and report for your clients, by referral or white-label, with named certified testers and a retest included. Talk to an expert.