Pen Testing Grant
We Are Sponsoring 100 Pen Testing Grants Again.
A penetration test is a safe, controlled attack on your own business, run by a professional, so you find the weak points before a criminal does. Capital Cyber is sponsoring 100 of them as in-kind grants through Cyber Grants Alliance, a nonprofit that gives cybersecurity grants to small businesses.
One penetration test by an independent tester, a written report reviewed by analysts, and a results call with Capital Cyber. The only charge is a $250 administrative fee, due after your application is approved.
What the Grant Is
One Pen Test, Sponsored by Capital Cyber, Granted by a Nonprofit.
Cyber Grants Alliance is a nonprofit that gives in-kind cybersecurity grants to small businesses. In-kind means the grant is a service delivered to you, not a payment. Capital Cyber sponsors the tests; Cyber Grants Alliance reviews the applications and awards the grants.
Why We Are Doing It
The rules that cover healthcare, financial and investment firms ask for testing and risk analysis, and the businesses they cover are often small. For most of them a penetration test is the one step they have never taken, usually because nobody has shown them what it involves.
We sponsored pen testing grants through Cyber Grants Alliance before, and we are doing it again, so that a business's first test happens before an incident rather than after one. The report is yours. The grant does not require you to buy anything from us.
What Is a Pen Test
A Safe, Simulated Attack, Before a Real One.
A penetration test, or pen test, is a professional trying to break into your business the way a criminal would, with your permission and under control, then telling you exactly what they found. Four steps, start to finish.
STEP 1
One link, one employee
We send a single link to one person on your team, the way an everyday invoice email would arrive. That is the whole setup. Nothing is installed and no hardware is shipped.
STEP 2
They click and keep working
The employee opens the link and goes back to their day. The test runs from that one foothold, the same place a real attacker would start.
STEP 3
The tester follows the attacker's routes
From that foothold the tester tries the paths an attacker would try: into Microsoft 365, through the firewall, across Active Directory, against your passwords, and out to what is already exposed on the dark web.
STEP 4
Analysts review and rank every finding
People, not just software, read every result. Each finding is sorted by severity and comes with the steps to close it, so you know what to fix first.
Where It Looks
The Five Places an Attacker Checks First.
These are the systems a small business runs on, and the ones criminals test first. The report covers each of them.
Who It Is For
One grant per organizationHealthcare under HIPAA
Practices, clinics and the businesses that serve them. HIPAA asks you to assess the risks and vulnerabilities to patient information. A pen test shows you where they are.
Firms under the FTC Safeguards Rule
CPA and tax firms, mortgage brokers, auto dealers and others who hold customer financial information. The rule calls for annual penetration testing unless you monitor your systems continuously.
SEC registered investment advisers
Regulation S-P requires written safeguards for customer information. A pen test shows whether the safeguards you wrote down hold up against an attacker.
Defense suppliers
Businesses in the defense supply chain that do not qualify for Cyber Grants Alliance's CMMC gap assessment grants can apply for this grant instead.
What You Receive
4 ITEMSOne penetration test
Run by a trusted independent tester, against the routes an attacker would take into your business.
A written report, reviewed by analysts
Every finding listed by severity, each with the steps to close it. Written to be read by an owner, not only by an engineer.
A results call with Capital Cyber
We walk you through the report, answer your questions and help you decide what to fix first. What you do next is your call.
A dated record
Proof that your business was tested, and when. The document insurers, auditors and examiners ask to see.
How It Works
Apply on Cyber Grants Alliance. The Fee Comes After Approval.
Four steps from application to results call. The only charge is a $250 administrative fee, and it is due only once Cyber Grants Alliance has approved your application.
STEP 1
Apply on Cyber Grants Alliance
The application lives on the Cyber Grants Alliance website, not here. Cyber Grants Alliance reviews every application.
STEP 2
Receive your approval email
If your business qualifies, Cyber Grants Alliance emails you an approval. There is nothing to pay before this point.
STEP 3
Pay the $250 administrative fee, then schedule
The administrative fee is due only after approval. Once it is paid, we schedule the test with you and name the one employee who will receive the link.
STEP 4
Test, then results call
The test runs while your team works. Analysts review the findings, you receive the written report, and we walk you through it on a call.
What it costs you: a $250 administrative fee, due only after approval and before the test is scheduled. Nothing is owed when you apply, and nothing further is owed after the results call.
Why It Matters
3 RULES16 CFR 314.4(d)(2)
FTC Safeguards Rule
Calls for annual penetration testing of your information systems unless you monitor them continuously. CPA and tax firms, mortgage brokers and auto dealers are among the businesses it covers.
45 CFR 164.308(a)(1)(ii)(A)
HIPAA Security Rule
Requires an accurate and thorough risk analysis of the risks and vulnerabilities to electronic protected health information. A pen test gives that analysis tested evidence instead of a guess.
17 CFR 248.30
SEC Regulation S-P
Requires written policies and procedures that safeguard customer records and information. A pen test shows whether the safeguards you wrote hold up in practice.
A pen test does not make a business compliant on its own. It gives you tested evidence for the risk analysis, the testing and the written safeguards each rule asks for, and it shows you what to fix next.
Frequently Asked Questions
8 QUESTIONSWhat is Cyber Grants Alliance?
A nonprofit that gives in-kind cybersecurity grants to small businesses. In-kind means the grant is a service delivered to you, in this case a penetration test, rather than a payment. Cyber Grants Alliance reviews the applications and awards the grants. Capital Cyber sponsors the tests.
Why is Capital Cyber doing this?
Because the businesses these rules cover are often small, and a penetration test is the step most of them have never taken. We sponsored pen testing grants through Cyber Grants Alliance before and are doing it again, so that the first test happens before an incident, not after one.
Where do I apply?
On the Cyber Grants Alliance Pen Testing Grant page. Cyber Grants Alliance reviews every application.
Is there a fee?
There is nothing to pay when you apply. If your application is approved, a $250 administrative fee is due before your test is scheduled. That is the only charge.
Will the test disrupt my business?
No. One employee clicks a link and keeps working while the test runs. Nothing permanent is installed and no hardware is shipped.
Does a pen test make my business compliant?
Not on its own. It gives you evidence for your risk analysis and testing, and shows you what to fix next.
Who runs the test?
A trusted independent tester runs it, and Capital Cyber walks you through the report on a results call.
What happens after the results call?
The report is yours. You can close the findings with your own team or your current IT provider, or ask us to help. The grant does not require you to buy anything from Capital Cyber.
Questions About the Grant?
Pick a time and we will walk you through how the test works and whether your business qualifies.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.