Advisory & CISO Services
Penetration Testing Services: Pentests That Prove the Path an Attacker Would Take. Fixed Price, Report in 14 Days, Free Retest.
A pentest should tell you which record one token can reach, which tenant a trial account can read, and how far one phished workstation gets before anything stops it.
We test web applications, APIs, SaaS platforms, mobile apps, networks and cloud environments by hand, senior-led, with tools for breadth. Each scope is a fixed price agreed in writing after one scoping call, the report lands within 14 days of the start, the retest after you fix is free, and the person on the scoping call does the testing. Fixed price, report in 14 days, free retest.
- Attack paths chained end to end, each with reproduction steps, business consequence and a fix
- Findings mapped to the PCI DSS, SOC 2, ISO 27001, DORA or NIS2 clause your auditor will cite
- Written rules of engagement: agreed windows, a named contact on each side, a stop condition
One door left ajar is all it takes. The pentest finds it and documents what sits behind it.
SEE THE DELIVERABLE
See what a useful
penetration test report looks like.
Review a combined engagement covering web, REST and GraphQL APIs, gRPC, SaaS tenant isolation, Android and iOS, networks, cloud, identity and CI/CD. Includes technical evidence, remediation and retest criteria.
62 pages. 24 findings. 14 charts, diagrams and matrices.
Illustrative penetration test. The organisation, systems and findings are fictional.
Get the sample report
A free PDF. Enter your email and company name, and we’ll email you a download link.
DEFINE YOUR SCOPE
Turn your testing requirements into a clear RFP.
Build one request for your applications, APIs, networks, and cloud. Review the scope, download your document, and send a copy to your inbox and our team.
REQUEST RECEIVED
Your RFP is submitted.
Reference: . Email copies are being sent to and Alexander at Atlant Security. Check your spam folder if needed.
You can also book a call to discuss the scope.
Scopes and leads every pentest personally, runs the remediation workshop with your engineers and signs the attestation letter your auditor reads.
Connect on LinkedIn01 / THE DETAIL
What Each Penetration Test Actually Tests
A scanner scopes by host. We scope by the question an attacker would ask of each layer of your estate, and each question is one of six pentests. Pick the scope that matches the question, or combine several into one proposal.
Web application pentest
One application, every role. Access control between users and tenants, session and password-reset flows, injection, business logic in checkout and approvals, file handling, and the path from a self-registered account to the admin console.
API pentest
REST, GraphQL and gRPC. Which records a low-privilege token can reach, object and function-level authorisation, token scope and lifetime, rate limits, SSRF through URL parameters, and the shadow versions nobody decommissioned.
SaaS platform pentest
Tenant isolation at every layer: IDs, storage paths, search indexes, exports and background jobs. Role escalation inside a tenant, SSO and SAML handling, integration tokens, admin impersonation and support tooling.
Mobile app pentest
iOS and Android. What a stolen phone gives away: local storage and keychain use, binary protections, runtime hooking, certificate pinning, session tokens on the device, deep links and WebViews, and the API behind the app.
Network pentest
External perimeter and internal network. Exposed services and remote access, lateral movement, Active Directory privileged paths such as Kerberoasting and ADCS misconfiguration, and segmentation between user, server and card-data networks.
Cloud pentest
AWS, Azure and GCP. IAM privilege-escalation paths, public storage, instance metadata, secrets in CI/CD pipelines, Kubernetes exposure, security groups, and the hybrid trust from on-premises Active Directory into the tenant.
Two variants sit alongside the six: the bank pentest, built around payment workflows, core-banking integrations and privileged access for banks and credit unions, and DORA TLPT, the threat-led, regulator-validated exercise for financial entities designated under Article 26, which runs alongside the annual pentest.
02 / THE DETAIL
The Attack Paths That Repeat Across the Estates We Test
One per scope, these are the findings that recur across the environments we assess. Most sit in who can reach what, on fully patched systems, which is why a scan of the same estate comes back clean.
Role checks enforced only in the browser
The admin menu is hidden from ordinary users and the endpoint behind it answers any session. One request with a copied URL turns a self-registered account into an operator.
Object IDs the API trusts
Swap your own invoice ID for the next integer and the API returns another customer’s record. Broken object level authorisation, API1 in the OWASP API Security Top 10, recurs across the APIs we test.
A tenant filter missing on one code path
The main query is scoped to the tenant. The export job, the search index or the webhook payload is scoped to nothing. A free-trial account reads another customer’s data through the gap.
Session tokens held in plain text on the phone
A long-lived token in app storage or a backup, with no binding to the device. Whoever holds the phone, or the backup, holds the account until the token expires months later.
A service account with its go-live password
Kerberoastable (MITRE ATT&CK T1558.003), cracked offline, and local admin on the servers that matter. One phished workstation to Domain Admin with every host fully patched.
A CI/CD key with far more than it needs
A deployment credential in a repository or a pipeline variable, attached to a role that reads every bucket and can assume the production role. One leak reaches the database.
03 / THE DETAIL
What the Report Has to Prove, and to Whom
A pentest report has two readers. Your engineer wants the exact request, the exact host and a fix that survives the next release. Your auditor, examiner or enterprise customer wants to see that an independent party tested the scope, that you understood the risk and closed it.
Ours carries both. The method follows NIST SP 800-115, every finding is mapped to the clause it bears on, the executive summary states what a board needs in two minutes, and the retest and attestation letter close the loop for the audit file. The same report supports SOC 2, ISO 27001, PCI DSS, HIPAA, DORA and NIS2 programmes, and NIST SP 800-53 control CA-8.
Financial entities designated under DORA have a separate, heavier regime, DORA TLPT, which we also deliver. Card environments add PCI DSS Requirement 11.4.5 segmentation testing to the network scope.
04 / THE DETAIL
Rules of Engagement for Live Production Systems
Before anything is touched, both sides sign rules a risk committee and a release manager can read.
- What is never done. Denial-of-service techniques, destructive payloads and real transactions stay out of every engagement. Test records we create are removed before the report is issued.
- Windows you set. Testing hours, blackout dates and release freezes are written into the rules. Anything touching a production database or an identity provider runs in a window you approve.
- A named contact and a stop condition. One escalation contact on each side, reachable throughout, and a written condition under which testing halts immediately.
- Evidence handling. Any personal or customer data encountered is redacted at capture, held encrypted for the engagement only, and destroyed on a documented date.
- Platform boundary respected. Cloud scopes follow the AWS customer penetration testing policy, the Azure penetration testing rules of engagement and the Google Cloud acceptable use policy. Hosted vendor platforms are tested at the integration surface.
05 / THE DETAIL
How the Engagement Runs
Five steps. The price is fixed at the first one, and the report lands inside fourteen days of the third.
Scoping call
Which scopes, roles and environments, and which auditor or customer will read the report. A proposal within 24 hours with a fixed price and timeline in writing.
Rules of engagement
Test windows, escalation contacts on both sides, test accounts and data, the cloud-provider rules that apply, and a written stop condition.
Manual testing
Reconnaissance first: subdomains, technologies, roles and trust relationships. Then senior-led exploitation, chaining weaknesses end to end against the agreed scope. Tools for breadth, people for authorisation and logic.
Report and workshop
Findings register with reproduction steps and severity, executive summary with regulatory mapping, and a live remediation workshop with your engineers.
Retest and attestation
One free retest after you fix, then an attestation letter signed by a named qualified individual, addressed to your auditor, your customer or your board.
06 / PRICING
Penetration Testing Pricing
Each scope is a fixed price. Larger or combined scopes are priced in one proposal with volume pricing; you approve the total before anything starts.
| Scope | What is covered | Testing | Price |
|---|---|---|---|
| External network perimeter | Internet-facing IP ranges, DNS, mail, remote access | 5-7 days | From $4,000 |
| API | Up to 50 endpoints, REST, GraphQL or gRPC | 5-7 days | From $4,000 |
| Web application | 1 application, all roles | 7-10 days | From $5,000 |
| Internal network and Active Directory | Internal ranges plus privileged-path analysis | 7-10 days | From $5,000 |
| Cloud infrastructure | One AWS, Azure or GCP environment | 7-10 days | From $6,000 |
| SaaS multi-tenant platform | Multi-tenant platform, all roles and tenant boundaries | 10-14 days | From $6,000 |
| Mobile app, single platform | iOS or Android, one application | Agreed at scoping | From $5,000 |
| Mobile app plus its API | iOS or Android plus the API behind it | 10-14 days | From $6,000 |
| Mobile app, both platforms | iOS and Android | Agreed at scoping | From $8,000 |
| Mobile app, both platforms plus API | iOS and Android plus the API behind them | Agreed at scoping | From $12,000 |
Every scope includes the findings register, the executive summary with regulatory mapping, the remediation workshop, one free retest and the attestation letter. The full list across all services is on the pricing page, and a standalone Active Directory assessment is priced on the AD security assessment page.
For small projects and ad-hoc work outside our pre-agreed packages or retainers, our standard hourly rate is $460.
07 / THE DETAIL
Penetration Test or Vulnerability Scan
Two controls that get bought as if they were one. Auditors know the difference, and the report has to show you do too.
Need the scan as well? The vulnerability assessment covers the NIST RA-5 scanning control and pairs with any scope above.
08 / THE DETAIL
Who Commissions a Penetration Test
Across 200+ security assessments in 14 countries since 2013, the estates have ranged over fintech, healthcare, SaaS, government contractors, private equity portfolios, law firms, manufacturing with OT, and ecommerce.
09 / THE DETAIL
Find Out What One Token, One Key or One Workstation Can Reach
One scoping call. Bring your last pentest report, your auditor’s request, or nothing at all. You will leave with a scope written as questions, a fixed price in writing, and a date for the report.
Scope My Pentest10 / THE DETAIL
Book the Scoping Call
Choose a time for your scoping call.
11 / FAQ
Penetration Testing FAQ
What is a penetration test?
How is a penetration test different from a vulnerability scan?
Which penetration test do we need?
How much does a penetration test cost?
How long does a penetration test take?
Do you test production systems, and can the test cause downtime?
How often should we run a penetration test?
What do we receive at the end, and is retesting included?
Who does the testing?
Will the report satisfy our SOC 2, ISO 27001, HIPAA or CMMC assessor?
12 / THE DETAIL
Related Services
Vulnerability assessment - Active Directory security assessment - Cloud security consulting - AWS security assessment - IT security audit - Bank pentest - DORA TLPT - SaaS virtual CISO - Pricing
Between annual pentests, Pentestas runs continuous AI penetration testing against the same scopes.
Comparing providers? See the best pentest companies ranked by scope or Our ranking of 40 penetration testing companies covers boutiques, research-led firms, PTaaS and autonomous platforms, with each one's pricing model.