--- title: "AI-Assisted Pentest: Agentic Testing, Human-Verified" url: https://mr-cyber.com/services/ai-assisted-pentest language: en description: "Agentic, automated pentest of web apps, APIs, external networks and cloud accounts. A senior tester verifies every finding. One-time €590 per target." --- # AI-assisted pentest with agentic, automated testing AI agents run the test, a senior tester steers it and verifies every finding. An AI-assisted pentest is an agentic, automated security test. AI agents test your web app, API, external network or cloud account, and a senior tester steers the run and verifies every finding before you see it. It is a separate option next to our manual pentests and complements a manual pentest rather than replacing it. One-time **€590** per target · monthly **€390** per target per month [See my fixed price](https://mr-cyber.com/quote?service=aiassisted) [See my fixed price](https://mr-cyber.com/quote?service=aiassisted) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) AI agents flag three candidates; the tester confirms one and discards two. - **One-time or monthly**monthly: a run every 2 weeks - **Own EU infrastructure**no third-party AI services - **Verified report**within 5 business days - **Free re-check**within 30 days ## A separate option. Our other services are manual pentests. You choose the AI-assisted pentest specifically. It complements a manual pentest rather than replacing it: for testing more often, between two manual pentests, or as a first check. Want your own AI application or LLM feature tested? That is our [AI & LLM pentest](https://mr-cyber.com/services/ai-llm-penetration-testing). How it differs from Continuous pentesting: there, a tester spends one manual test day on your systems every month. Here, an AI-assisted run happens every 2 weeks. See [Continuous pentesting](https://mr-cyber.com/services/continuous-pentesting). ## Who it’s for - Teams that ship often and want their web app or API tested between manual pentests - Companies that want their external network or cloud account tested on a regular schedule - Clients who had a manual pentest and want new releases checked until the next one - Startups that want a first check of their product before a manual pentest ## What gets tested ### Web applications - One web app per target - Tested with the test accounts and roles you provide - Logins, access between users, input handling and configuration ### APIs - One API with up to 50 endpoints per target - Tested with your API documentation, if you have it - Authentication, access to other users' data and input handling ### External networks - One range with up to 16 IP addresses per target - Every service reachable from the internet in that range - Exposed services, outdated software and weak configuration ### Cloud accounts - One cloud account per target - Configuration and permissions - Resources that are exposed to the internet ## How the AI-assisted pentest works. Agents run it, a tester verifies it. Shown for the one-time plan. The monthly plan repeats the run every 2 weeks. business days to the report 5 days for the free re-check 30 weeks between runs, monthly plan 2 1. Phase 1 ### Target & start date Price per target online. A call, if you like. You pick the date 2. Phase 2 ### Agent runs AI agents test the target on our EU infrastructure. Automated run 3. Phase 3 ### Tester verifies A senior tester checks every finding before delivery. Before delivery 4. Phase 4 ### Report Verified findings with clear fix guidance. Within 5 business days 5. Phase 5 ### Free re-check One re-check of your fixes. Within 30 days ## How it works ## How an AI-assisted pentest works ### AI agents do the testing Agentic AI runs the automated part of the test against the targets you authorised. The agents explore the target, try attacks and record what they find. ### A senior tester steers and verifies The tester sets up each run, steers the agents and checks every finding before it reaches you. You get verified findings with evidence and fix guidance, and the tester answers your questions. ### Your data stays with us The AI-assisted pentest runs on our own EU infrastructure. Your data does not go to third-party AI services. ### A separate option next to the manual pentests All our other services are manual pentests. Choose the AI-assisted pentest when you want to test more often or between manual pentests. It complements a manual pentest and does not replace it. ## Two options. Fixed prices per target. ### One-time AI-assisted pentest One run with a report. A good first check, or before a release. €590 per target - Every finding verified by the tester before delivery - A report within 5 business days - One free re-check of your fixes within 30 days [See my fixed price](https://mr-cyber.com/quote?service=aiassisted&plan=once) ### Monthly AI-assisted pentest A full run every 2 weeks, for as long as you keep testing. €390 per target per month - A full run every 2 weeks - Every finding verified by the tester - A short report after each run, with all findings kept in one running list - Fixes re-checked in the next run or on request Cancel monthly, no minimum term. 10% off when you pay a year upfront: €4,212 per target per year. [See my fixed price](https://mr-cyber.com/quote?service=aiassisted&plan=monthly) 1 target = 1 web app, 1 API with up to 50 endpoints, 1 external range with up to 16 IP addresses, or 1 cloud account (1 AWS account, 1 Azure subscription or 1 Google Cloud project). More targets: price × number of targets. Services exclusively for businesses. ## What you get - Only findings the tester has verified, each with evidence and fix guidance - One-time: a report within 5 business days and one free re-check of your fixes within 30 days - Monthly: a short report after each run, with all findings kept in one running list - Monthly: fixes re-checked in the next run or on request - Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub - Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 Pentest report · Admin & Söhne GmbH · MC-2026-027 Risk: Medium CVSS 3.1 · 6.5 Open · retest included ### Live newsletter API key published in the website code shop.admin-soehne.example · /assets/app.js · email marketing service CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N #### Description The agents flagged a key in a JavaScript file of the shop. The tester confirmed by hand that it is the live key of the email marketing service. It can read the subscriber list and send mailings to it. #### Steps to reproduce 1. Load the shop’s public JavaScript file that the agents flagged. 2. Find the key the agents reported in it. 3. Check the key’s rights with the client’s admin: it can read the subscriber list and send mailings. ``` Agent flag: key found in /assets/app.js of the shop (shortened) Tester check: live key of the email marketing service Key rights: read subscriber list = yes · send mailings = yes ``` #### Business impact Anyone can send a phishing mail to all subscribers from your real sender address, and read their names and email addresses. Reputation damage and a GDPR incident in one, though no order or payment data is exposed. #### Remediation Revoke the key and issue a new one that stays on the server. Send sign-ups to the marketing service through your own backend. Keep the agents’ secret check running on every release. OWASP Top 10 2021: A05 Security Misconfiguration · CWE-798 (Use of Hard-coded Credentials) · CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) ## Frequently asked questions How is this different from your manual pentests? In a manual pentest, the tester does the testing by hand. In an AI-assisted pentest, AI agents do the automated testing, and a senior tester steers the run and verifies every finding before delivery. All our other services are manual pentests. The AI-assisted pentest is a separate option you choose specifically, and it complements a manual pentest rather than replacing it. How much does an AI-assisted pentest cost? The one-time AI-assisted pentest costs €590 per target. The monthly AI-assisted pentest costs €390 per target per month. More targets cost the price times the number of targets. What counts as a target? One web app, one API with up to 50 endpoints, one external range with up to 16 IP addresses, or one cloud account. One cloud account is one AWS account, one Azure subscription or one Google Cloud project. What are the terms of the monthly AI-assisted pentest? There is no minimum term. You can cancel monthly. If you pay a year upfront, you get 10% off. How is the monthly AI-assisted pentest different from continuous pentesting? Continuous pentesting is a manual test day by a tester every month. The monthly AI-assisted pentest is an AI-assisted run every 2 weeks, with every finding verified by the tester. Does our data go to an AI provider? No. The AI-assisted pentest runs on our own EU infrastructure. Your data does not go to third-party AI services. Does it find every vulnerability? No test does, manual or automated. The agents cover a lot of ground quickly, and the tester checks every finding before you see it. Flaws in business logic and longer attack chains are where a manual pentest is stronger. Is it enough for an audit or a compliance requirement? If a standard, an auditor or a customer asks for a penetration test, choose a manual pentest. The AI-assisted pentest helps you test more often in between. Can it run against our production systems? Yes, if you authorise it. Before the first run we agree in writing which targets may be tested and when, and every run stays within that authorisation.