I had two pen test quotes on my desk, both wanted access to everything and about two weeks. A colleague at another firm mentioned Leaktrace so we tried that first since it didn't need anything from us. No logins, nothing installed. Report came back in 3 days. First thing on it was that anyone could send an email as our firm and it would get delivered. I asked our IT guy about it and he went a bit quiet, then fixed it that afternoon. Apparently, a pen test wouldn't have flagged that because it's not really a hole, it's a record we never set up. Review collected by and hosted on G2.com.

It's not a pen test and they say so. So if you need someone actually trying to get in, you still need that. I also found the full technical document heavy going, I read the short one and gave the rest to IT. Review collected by and hosted on G2.com.