START HERE
FLAGSHIP_SERVICE // Q2_2026
Penetration Test
A fixed-price VAPT — vulnerability assessment and penetration testing — of your web app or API.
A real engineer plus 75 AI-powered scanners try to break into your application — then you get a PDF report your CEO can read, your auditor will accept, and your engineers can actually fix. The same engine powers our PhantomDragon AI scanner; if you're searching VAPT in Sri Lanka, start there.
$2,499
Fixed price · no hidden fees
5-7 days
From kickoff to delivery
75
Attack categories tested
FREE
Re-test after you patch
DELIVERABLES 01
What you actually get
Most pentest firms hand you a 60-page Word doc and disappear. We give you six artifacts a real team can use.
Executive PDF report
Plain-English findings written for a CEO, not just a CTO. Includes risk score, severity breakdown, AI-generated executive summary.
Developer JSON + SARIF
Machine-readable findings for SonarQube, GitHub Advanced Security, your CI pipeline.
Reproducible proof
Each high-severity finding includes a step-by-step PoC your engineers can replicate.
Free re-test
Once you patch, we re-run the scan and issue an updated clean report — no extra charge.
30-day Q&A
Email your assigned engineer with follow-up questions for 30 days after delivery.
Attestation letter
Signed PDF letter you can hand to auditors, customers, or VCs as proof of testing.
SAMPLE REPORT
See an anonymized 8-page sample of what your team will receive. Real findings, real format, real attestation block.
IDEAL FOR 02
Who buys this
B2B SaaS preparing for SOC 2 / ISO 27001 audit
Startups in VC due-diligence (Series A / B / C)
Healthtech & telehealth (HIPAA prep)
Fintech / lending / payments (PCI-DSS lighter pass)
E-commerce platforms hitting $1M+ ARR
Companies that just had a security questionnaire come back from an enterprise prospect
SCOPE 03
What we test
The engagement is full web application penetration testing plus API security testing — your public app, your REST or GraphQL endpoints, authentication, and the business logic behind them. Everything in scope by default:
Web application (your public-facing app)
REST or GraphQL API
Up to 3 subdomains
Authentication / session management
Business-logic abuse (price tampering, IDOR, auth bypass)
OWASP Top 10 + 65 other attack categories
TLS / DNS / certificate config
Stripe / payment webhook handling (if applicable)
OUT OF SCOPE (by default)
Mobile apps, internal corporate networks, social engineering / phishing, denial-of-service testing, and third-party SaaS we don't control (Stripe, Auth0, etc.). Each is available as an add-on — talk to us about pricing.
COMPLIANCE 04
Compliance evidence your auditor accepts
The signed attestation letter and executive PDF satisfy the technical-testing requirement for PCI DSS 11.4, SOC 2, and ISO 27001, and the test follows OWASP and NIST 800-115 methodology — so the report is built to clear an audit, not just inform your engineers. Each finding maps to OWASP, PCI DSS, SOC 2, ISO 27001, and NIST, the same compliance crosswalk the AI engine produces.
This is compliance penetration testing without the policy-and-evidence overhead: the Pentest tier covers the independent-testing control in each framework. Full compliance prep — writing policies, gathering control evidence — is a separate Custom engagement.
TIMELINE 05
From cal link to clean report
Typical engagement runs 5-7 calendar days. Expedited 72-hour delivery available for $1,000.
Day 0
Booking
15-minute call. We confirm scope, sign the engagement letter, you send target details.
Day 1-3
Scanning
PhantomDragon AI runs the full 75-scanner sweep with manual oversight. Average runtime: 3-6 hours.
Day 3-5
Analysis
Lead engineer reviews each finding, eliminates false positives, links multi-step attack chains.
Day 5-7
Delivery
PDF + JSON + SARIF + attestation. 30-min walkthrough call to explain every HIGH finding.
Day 7-30
Re-test
Once you patch, we re-scan free and issue an updated report. Q&A inbox stays open for 30 days.
COST 06
What it costs — and why fixed price
The penetration testing cost here is a flat $2,499 — the whole engagement, not an hourly estimate. An equivalent web-and-API engagement from a traditional firm typically runs $5,000 to $35,000 once scoping, hours, and change orders are added. We quote one number and hold it. Expedited 72-hour delivery is $1,000 extra; the ongoing security retainer is $2,999/mo. Full pricing lives on the pricing page.
QUESTIONS 07
Common questions
Why is this so much cheaper than the big firms?
+
We're a small senior team based in Sri Lanka — engineering costs ~1/5 of US bay-area rates. We pass that on. The work is the same caliber; the overhead isn't.
Will the report be accepted by my auditor or enterprise customer?
+
Yes — every report follows OWASP / NIST methodology, includes scope statement, severity-ranked findings, executive summary, remediation guidance, and a signed-and-dated attestation. We can share sample anonymized reports under NDA before you commit.
What about HIPAA / SOC 2 / PCI-DSS specific requirements?
+
The Pentest tier covers the technical-testing requirement in all three frameworks. For full compliance prep (policies, controls, evidence gathering), we have a Custom / Enterprise engagement — talk to us.
Do you test production or a staging environment?
+
Either works. Staging is safer; production is more accurate. We run in non-destructive mode regardless — no data modification, no real exploits against live customer records.
What if you find a critical issue mid-scan?
+
We pause immediately, message your point of contact within an hour, and confirm before continuing. Critical findings never sit waiting for the final report.
Can we expedite delivery?
+
Yes — 72-hour delivery is available for $1,000 extra. Most engagements don't need it; SOC 2 auditors are fine with 5-7 days.
What's NOT included?
+
Mobile apps (iOS/Android), internal corporate networks, social engineering / phishing employees, denial-of-service testing, and third-party services we don't control (Stripe, Auth0, etc.). Most of these are available as add-ons.
Stop losing enterprise deals over a missing pentest report.
One $2,499 engagement. Fixed price. Five to seven days. A real report you can hand to an auditor on Monday.
ENCRYPTED_INTAKE // GLOBAL_DELIVERY // PO_READY