Skip to content

AI-assisted pentest with agentic, automated testing

AI agents run the test, a senior tester steers it and verifies every finding.

An AI-assisted pentest is an agentic, automated security test. AI agents test your web app, API, external network or cloud account, and a senior tester steers the run and verifies every finding before you see it. It is a separate option next to our manual pentests and complements a manual pentest rather than replacing it.

One-time €590 per target · monthly €390 per target per month

See my fixed price
See my fixed price

Prefer to talk first? Book a call

AI run 3 candidates ? Rate limit ? Order access ? TLS setting Tester verifies each one by hand Discarded Rate limit Confirmed Order access Discarded TLS setting
AI agents flag three candidates; the tester confirms one and discards two.
  • One-time or monthlymonthly: a run every 2 weeks
  • Own EU infrastructureno third-party AI services
  • Verified reportwithin 5 business days
  • Free re-checkwithin 30 days

A separate option. Our other services are manual pentests.

You choose the AI-assisted pentest specifically. It complements a manual pentest rather than replacing it: for testing more often, between two manual pentests, or as a first check.

Want your own AI application or LLM feature tested? That is our AI & LLM pentest.

How it differs from Continuous pentesting: there, a tester spends one manual test day on your systems every month. Here, an AI-assisted run happens every 2 weeks. See Continuous pentesting.

Who it’s for

  • Teams that ship often and want their web app or API tested between manual pentests
  • Companies that want their external network or cloud account tested on a regular schedule
  • Clients who had a manual pentest and want new releases checked until the next one
  • Startups that want a first check of their product before a manual pentest

What gets tested

Web applications

  • One web app per target
  • Tested with the test accounts and roles you provide
  • Logins, access between users, input handling and configuration

APIs

  • One API with up to 50 endpoints per target
  • Tested with your API documentation, if you have it
  • Authentication, access to other users' data and input handling

External networks

  • One range with up to 16 IP addresses per target
  • Every service reachable from the internet in that range
  • Exposed services, outdated software and weak configuration

Cloud accounts

  • One cloud account per target
  • Configuration and permissions
  • Resources that are exposed to the internet

How the AI-assisted pentest works. Agents run it, a tester verifies it.

Shown for the one-time plan. The monthly plan repeats the run every 2 weeks.

business days to the report
5
days for the free re-check
30
weeks between runs, monthly plan
2

  1. Phase 1

    Target & start date

    Price per target online. A call, if you like.

    You pick the date

  2. Phase 2

    Agent runs

    AI agents test the target on our EU infrastructure.

    Automated run

  3. Phase 3

    Tester verifies

    A senior tester checks every finding before delivery.

    Before delivery

  4. Phase 4

    Report

    Verified findings with clear fix guidance.

    Within 5 business days

  5. Phase 5

    Free re-check

    One re-check of your fixes.

    Within 30 days

How it works

How an AI-assisted pentest works

AI agents do the testing

Agentic AI runs the automated part of the test against the targets you authorised. The agents explore the target, try attacks and record what they find.

A senior tester steers and verifies

The tester sets up each run, steers the agents and checks every finding before it reaches you. You get verified findings with evidence and fix guidance, and the tester answers your questions.

Your data stays with us

The AI-assisted pentest runs on our own EU infrastructure. Your data does not go to third-party AI services.

A separate option next to the manual pentests

All our other services are manual pentests. Choose the AI-assisted pentest when you want to test more often or between manual pentests. It complements a manual pentest and does not replace it.

Two options. Fixed prices per target.

One-time AI-assisted pentest

One run with a report. A good first check, or before a release.

€590 per target

  • Every finding verified by the tester before delivery
  • A report within 5 business days
  • One free re-check of your fixes within 30 days
See my fixed price

Monthly AI-assisted pentest

A full run every 2 weeks, for as long as you keep testing.

€390 per target per month

  • A full run every 2 weeks
  • Every finding verified by the tester
  • A short report after each run, with all findings kept in one running list
  • Fixes re-checked in the next run or on request

Cancel monthly, no minimum term. 10% off when you pay a year upfront: €4,212 per target per year.

See my fixed price

1 target = 1 web app, 1 API with up to 50 endpoints, 1 external range with up to 16 IP addresses, or 1 cloud account (1 AWS account, 1 Azure subscription or 1 Google Cloud project). More targets: price × number of targets.

Services exclusively for businesses.

What you get

  • Only findings the tester has verified, each with evidence and fix guidance
  • One-time: a report within 5 business days and one free re-check of your fixes within 30 days
  • Monthly: a short report after each run, with all findings kept in one running list
  • Monthly: fixes re-checked in the next run or on request
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price

Prefer to talk first? Book a call

Pentest report · Admin & Söhne GmbH · MC-2026-027
Risk: Medium CVSS 3.1 · 6.5 Open · retest included

Live newsletter API key published in the website code

shop.admin-soehne.example · /assets/app.js · email marketing service

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

The agents flagged a key in a JavaScript file of the shop. The tester confirmed by hand that it is the live key of the email marketing service. It can read the subscriber list and send mailings to it.

Steps to reproduce

  1. Load the shop’s public JavaScript file that the agents flagged.
  2. Find the key the agents reported in it.
  3. Check the key’s rights with the client’s admin: it can read the subscriber list and send mailings.
Agent flag: key found in /assets/app.js of the shop (shortened)
Tester check: live key of the email marketing service
Key rights: read subscriber list = yes · send mailings = yes

Business impact

Anyone can send a phishing mail to all subscribers from your real sender address, and read their names and email addresses. Reputation damage and a GDPR incident in one, though no order or payment data is exposed.

Remediation

Revoke the key and issue a new one that stays on the server. Send sign-ups to the marketing service through your own backend. Keep the agents’ secret check running on every release.

OWASP Top 10 2021: A05 Security Misconfiguration · CWE-798 (Use of Hard-coded Credentials) · CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)

Frequently asked questions

How is this different from your manual pentests?
In a manual pentest, the tester does the testing by hand. In an AI-assisted pentest, AI agents do the automated testing, and a senior tester steers the run and verifies every finding before delivery. All our other services are manual pentests. The AI-assisted pentest is a separate option you choose specifically, and it complements a manual pentest rather than replacing it.
How much does an AI-assisted pentest cost?
The one-time AI-assisted pentest costs €590 per target. The monthly AI-assisted pentest costs €390 per target per month. More targets cost the price times the number of targets.
What counts as a target?
One web app, one API with up to 50 endpoints, one external range with up to 16 IP addresses, or one cloud account. One cloud account is one AWS account, one Azure subscription or one Google Cloud project.
What are the terms of the monthly AI-assisted pentest?
There is no minimum term. You can cancel monthly. If you pay a year upfront, you get 10% off.
How is the monthly AI-assisted pentest different from continuous pentesting?
Continuous pentesting is a manual test day by a tester every month. The monthly AI-assisted pentest is an AI-assisted run every 2 weeks, with every finding verified by the tester.
Does our data go to an AI provider?
No. The AI-assisted pentest runs on our own EU infrastructure. Your data does not go to third-party AI services.
Does it find every vulnerability?
No test does, manual or automated. The agents cover a lot of ground quickly, and the tester checks every finding before you see it. Flaws in business logic and longer attack chains are where a manual pentest is stronger.
Is it enough for an audit or a compliance requirement?
If a standard, an auditor or a customer asks for a penetration test, choose a manual pentest. The AI-assisted pentest helps you test more often in between.
Can it run against our production systems?
Yes, if you authorise it. Before the first run we agree in writing which targets may be tested and when, and every run stays within that authorisation.

Manual pentests for the same targets

AI-assisted pentest: your price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call