Penetration testing · Hulbert, Oklahoma
I'm Nightjar. I run pen tests, security audits, and incident-response retainers for small and mid-sized teams — clinics, credit unions, and family-run shops that hold real customer data. You get the holes, the fixes, and a report I'll read back to you in plain English.
how I work
I don't sell fear. I find the doors an attacker would rattle, tell you which ones actually swing open, and stay with you until they're locked. No jargon dump, no 200-page PDF you'll never read — just the handful of things that matter and exactly how to fix them.
who I sit down with
Most of my clients don't have a security department. They have one overworked IT person, a compliance deadline, and a nagging worry. That's exactly who I'm built for.
You need to prove the front door, the portal, and the backups are actually locked — not just assume it. I test them the way someone motivated would, then hand you HIPAA-ready evidence.
An examiner wants a penetration test on file by a date. I scope it fast, run it clean, and give you a report your auditor will accept and your board can read.
Something feels off — a wire that almost went out, a mailbox rule you didn't make. I come in, figure out what happened, contain it, and tell you plainly how bad it was.
You bought or built an app and nobody's ever looked at it hard. I assess the web app and the accounts around it, and rank what to fix first by real-world risk, not scary color codes.
what I offer
Fixed-scope engagements with the number up front. Bigger or unusual environments get a quote after a free 30-minute call — I'd rather size it right than guess.
I attack your internet-facing systems the way a real intruder would — email, VPN, portals, exposed servers. You get the exploit chain, a live debrief, and a retest of the fixes at no extra charge. Best for compliance deadlines and “are we actually safe” questions.
scope this →A guided walk through your accounts, cloud, backups, and email settings to catch the quiet gaps — the shared admin login, the disabled MFA, the backup that hasn't run since March.
scope this →When something goes wrong, you already have my number and a callback commitment. I keep a warm map of your environment so I'm not starting from zero mid-crisis. Includes a yearly tabletop drill with your team.
scope this →A realistic, ethical phishing round for your staff, followed by a short, no-shame training session. You'll know who clicks and, more importantly, why — and how to shrink that number.
scope this →Deep testing of a single app — auth, business logic, injection, access control — the flaws automated scanners miss. Ranked by real impact, with fixes your developers can act on this sprint.
scope this →before you call
No. I agree the rules of engagement with you in writing first — what's in scope, what's off-limits, and the hours we run. I test carefully and stay in constant contact. Nothing goes loud without your sign-off.
Small teams are the ones attackers automate against most. If a full test is more than you need right now, start with the $3,400 audit — it catches the common, costly gaps first, and we can go deeper later.
Most external tests run about a week of active work, with your report typically in hand within 48 hours of finishing. Live incidents are different — for retainer clients I commit to a callback within two hours.
Yes. There's a one-page summary for the people who sign checks and detailed steps for the people who fix things. Then I get on a call and read it back with you, so nothing gets lost in translation.
Retesting is included on penetration tests. Once your team patches, I re-check the findings and update the report so you have clean evidence to hand an auditor or a customer.
what you can count on
No boilerplate — just the commitments I actually hold myself to on every engagement.