Standard Pentest
Billed by the hour
Cost tracks consultant time, not your actual risk. A 20-person SaaS company gets quoted the same kind of engagement as a bank.
Pentesting for SOC 2, ISO 27001, HIPAA & PCI
Your auditor requires a pentest. Now you can actually get one.
Pentests used to mean weeks of scoping calls and consultant-hour invoices. Standard Pentest scopes your test in minutes with AI, runs it against a published standard, and delivers an audit-ready report in 24 hours, reviewed and signed by a human.
Scoped in minutes
Results in 24 hours
Human-reviewed, auditor-ready
Scope your pentestQuestion 1 of 5
Illustration of the AI scoping assistant
~5 minto scope your test
24 hrsto results after you authorize
100%of findings validated by a human
1published standard, every test
The problem
Why pentests have been out of reach for most SMBs
Every company pursuing SOC 2, ISO 27001, HIPAA or PCI needs a pentest. But pentesting was built for enterprises, and priced that way.
Weeks to scope and schedule
Discovery calls, scoping spreadsheets and waitlists, all while your audit deadline gets closer.
No standard
Two firms, two completely different tests, and no way to know what was actually done. So there's no pressure to make it efficient.
What changed
We bent the cost curve.
Traditional pentests scale cost with human hours: the more complex the vulnerability, the more you pay to find it. We put specialized AI agents on the volume of testing and security engineers on the judgment.
The result is an enterprise-grade method at a cost that fits an SMB.
Traditional pentesting. Human hours only, with no automation or feedback loop.
Standard Pentest. AI agents plus human review on every finding.
The Standard
Read The Standard →
A pentest you can actually understand
Every Standard Pentest runs the same published checks, so you know exactly what was tested, your auditor knows exactly what they're reading, and next year's test is a true comparison.
A published standard
Every test runs the same checks, starting with OWASP ASVS Level 1 for web applications. You know exactly what was tested, every time.
AI does the volume, humans do the judgment
Specialized agents probe every endpoint. A security engineer validates every finding and signs the report.
Scoped in minutes, results in 24 hours
No discovery calls, no scoping spreadsheets, no waiting weeks for a start date.
Clear reporting
Attack paths and priorities up front, with a plain-language explanation and fix for every finding. Written for the people who'll fix it.
Compliance-ready evidence
Signed attestation letter for auditors, insurers and customers, with findings mapped to the control you're audited on.
SOC 2 CC4.1 / CC7.1 · ISO 27001 A.8.8 · PCI DSS 11.4 · HIPAA 164.308(a)(8)Right-sized for your risk
SMBs face automated, commodity attacks, not nation-state teams. You get a strong baseline you can measure year over year, with human-led spot checks when you want to go deeper.
How it works
See every step in detail →
From "we need a pentest" to an audit-ready report
- 01~5 min
Scope with AI
Enter your domain and answer a few questions: audit framework, deadline, user roles, data you handle. Get your scope and a fixed quote.
- 02Same day
Authorize
Verify you own the domain and approve the rules of engagement. No destructive tests, no denial-of-service.
- 03Live
Agents test
Specialized AI agents each hunt one class of vulnerability. Watch coverage and findings as they land.
- 04Every finding
Humans validate
A security engineer re-checks each finding, rates severity and signs off. No false positives in your report.
- 0524 hours
Report, letter, retest
Audit-ready report, signed attestation letter, and a retest once you've fixed what we found.
No discovery calls. No scoping spreadsheets. No waiting weeks for a start date.
Same audit requirement. A completely different experience.
You're priced on the size of your attack surface, not on how many hours a consultant bills.
| Traditional pentest | Standard Pentest | |
|---|---|---|
| Scoping | Discovery calls and scoping sheets, often weeks | AI scoping in about 5 minutes |
| How it's priced | Consultant hours | Size of your attack surface, fixed quote up front |
| What gets tested | Varies by tester | A published standard, the same every time |
| Time to results | Weeks out | 24 hours after you authorize |
| Visibility | At the final readout | Live progress, critical findings flagged immediately |
| Retest after fixes | Often billed separately | Included |
Meet the crew
Specialized agents, each hunting one class of vulnerability
Every engagement runs the full crew, and every finding they surface is independently re-exploited and then reviewed by a person.
Recon
SURFACEMines your JavaScript and probes hosts to find every endpoint, including the ones you forgot about.
Access Control
A01Tries to read and change other users' data. The most common serious flaw in SaaS apps.
Login & Sessions
A07Attacks sign-in, password reset, tokens and session handling.
Server-side
A03 · A10Injection, SSRF and GraphQL abuse against your APIs.
Browser
A03 · A05XSS, clickjacking and other attacks that run in your users' browsers.
Business Logic
A04Abuses your workflows: skipping payment steps, escalating plans, bypassing limits.
Validation
PROOFIndependently re-exploits every finding and captures evidence before a human reviews it.
Proof · we tested ourselves first
Before testing anyone else, we pointed the agents at our own platform.
In a 12-hour first pass the crew mapped 346 endpoints across 9 hosts and found 3 high-severity issues, including a parameter that could have redirected logins to an attacker. We fixed every finding and verified the fixes.
346endpoints discovered
9hosts mapped
12hfirst-pass window
3 → 0high-severity issues, fixed and verified
Our mission
Pentesting shouldn't be a luxury. Every company that needs one for compliance should be able to get a clear, standard, affordable test, without a sales process.
For compliance platforms
Partner with us
Using Vanta, Drata, Secureframe or Thoropass? Your pentest control just got easy.
Audit-ready evidence in a predictable format, on a timeline that fits your audit window. Compliance platforms and audit firms can partner with us to offer one consistent standard to every customer.
FAQ
Questions compliance buyers ask
Something else? Email sales@standardpentest.com and a person will answer.
What is automated pentesting, and isn't it just a vulnerability scan?
No. A scanner matches known signatures. Our AI agents behave like a human tester against your web application and APIs: they chain requests, test whether one user can reach another user's data, abuse business logic and prove real impact. Every finding is independently re-exploited and then validated by a security engineer before it reaches your report.
Will my auditor accept it?
Your report includes scope, methodology, coverage, findings mapped to your audit control, human sign-off and a signed attestation letter: the elements auditors look for in any pentest. It's accepted as evidence for SOC 2 (CC4.1, CC7.1), and maps to ISO 27001 A.8.8, PCI DSS 11.4 and HIPAA 164.308(a)(8).
Why don't you list prices?
Every app is different. Your price depends on the size of your attack surface (apps, hosts, endpoints and user roles), not on consultant hours. Our AI scoping assistant maps your surface and gives you a fixed quote in minutes, before you commit to anything.
How fast is it, really?
Scoping takes about five minutes. Once you verify domain ownership and authorize the test, most assessments deliver results within 24 hours. Larger or highly segmented environments may take longer, and your scope tells you up front.
Is it safe to run against production?
Yes. We never run destructive payloads or denial-of-service tests, and testing only starts after you verify you own the domain and authorize the test in writing. You can also choose to test a staging environment.
Do you provide an attestation letter?
Yes. Every engagement includes a signed attestation letter you can share with auditors, cyber insurers and customers, plus a retest to show your fixes are in place.
How often should we test?
Most frameworks expect a pentest at least annually and after significant changes. Because every Standard Pentest runs the same published checks, each test is directly comparable to the last, so you can show measurable improvement.
What if I need more than a baseline?
Add human-led spot checks for deeper analysis of specific areas. For red teaming, social engineering or a fully custom methodology, we'll introduce you to a partner firm we trust.
Audit coming up? Get scoped today.
Answer a few questions, see your exact scope and fixed quote. No call required.
A pentest, demystified, step by step.
Here's exactly what happens from the moment you enter your domain to the moment your auditor has your letter. You can see what's happening at every step.
Step 01 · about 5 minutes
Scope with AI
Enter your domain. Our scoping assistant passively maps your public attack surface (endpoints, subdomains, login pages) without sending a single request to your app. Then it asks a few plain-English questions.
- What's driving the test (SOC 2, ISO 27001, HIPAA, PCI, a customer request)
- Your deadline
- How many kinds of users log in
- The most sensitive data you handle
- Where to test: production or staging
You get a scope written for your framework and a fixed quote based on the size of your attack surface.
Step 02 · same day
Authorize the test
Nothing touches your app until you prove you own the domain and approve the rules of engagement in writing. The defaults are safe for production, and you can tighten them.
Step 03 · live
Agents test every endpoint
A crew of specialized AI agents works through your app in parallel. Each hunts one class of vulnerability: access control, login and sessions, injection, browser-side attacks and business logic. You can watch coverage climb and findings land in real time.
Step 04 · every finding
Humans validate
A validation agent re-exploits each finding independently and captures evidence. Then a security engineer reviews it, confirms the severity and signs off. If it isn't real, it doesn't go in your report.
Step 05 · 24 hours
Report, letter, retest
You get an audit-ready report with a plain-English executive summary, findings mapped to your framework and a clear fix for each, plus a signed attestation letter. Fix the issues, request your retest, and your letter shows them resolved.
Five minutes to a scope and a fixed quote.
No call required. Nothing is sent to your app until you authorize it.
What a Standard Pentest is, and exactly what it tests.
There's no industry definition of a pentest. Two firms can deliver two completely different tests under the same name. We publish ours, so you, your auditor and your compliance platform know exactly what was done.
The philosophy: the test should fit the threat
In the physical world, a corner shop doesn't hire the same security as a bank vault, because it doesn't face the same criminals. Cybersecurity is no different. Large enterprises are targeted by sophisticated criminal groups and nation-state teams. Most small and mid-sized businesses face automated, commodity attacks that sweep the internet for common weaknesses.
Yet the industry sells the same hours-based, enterprise-style engagement to both. The Standard sets a clear, rigorous baseline sized for the threats SMBs actually face, delivered the same way every time so it can be measured, compared and improved. When you need more, you add human-led depth on top.
A Standard Pentest is
- A test of your web applications and APIs, from the outside, as an attacker would see them
- Authenticated testing across each user role you give us
- Aligned to OWASP ASVS Level 1 and the OWASP Top 10
- Every finding re-exploited, evidenced and reviewed by a human
- The same checks, report format and severity rules every time
A Standard Pentest is not
- A red team engagement or adversary simulation
- Social engineering or physical access testing
- Internal network or cloud configuration testing
- Denial-of-service, load testing or destructive actions
- A source code review
What every test checks
Each category below runs on every engagement, aligned to OWASP ASVS Level 1. Your report includes coverage for each one.
Access controlCan one user read or change another user's or tenant's data? Can a regular user reach admin functions?
AuthenticationSign-in, password reset, MFA, account lockout and credential handling.
Session managementToken generation, expiry, fixation and logout behavior.
InjectionSQL, command, template and other injection against every input we discover.
Server-side request forgeryWhether your server can be tricked into fetching internal or attacker-chosen resources.
Browser-side attacksCross-site scripting, clickjacking, open redirects and unsafe cross-window messaging.
Business logicSkipping payment steps, reusing discounts, exceeding plan limits, abusing workflows.
API & web servicesUndocumented endpoints, mass assignment, GraphQL abuse and exposed specs.
Configuration & headersSecurity headers, CORS, TLS, exposed debug or admin interfaces.
Data exposure & errorsSensitive data in responses, URLs or error messages and stack traces.
Who does what
Automation handles the volume. People handle the judgment.
AI agents
- • Map your attack surface: hosts, endpoints, auth flows
- • Test every in-scope endpoint against every check category
- • Chain requests and prove impact like a human tester
- • Independently re-exploit each finding and capture evidence
Security engineers
- • Review every finding before it reaches you
- • Confirm severity and remove anything that isn't real
- • Sign the report and attestation letter
- • Lead optional spot checks when you want more depth
Severity, the same way every time
Findings are rated using CVSS as a base, adjusted for real-world exploitability in your app, and explained in plain language.
CRITICAL
Immediate risk of full compromise or unrestricted data access, with no meaningful barrier to exploitation.
HIGH
Significant impact with a practical exploitation path: credential theft, unauthorized access to sensitive data, or changing critical state.
MEDIUM
Meaningful impact under specific conditions, such as user interaction, chaining with another finding, or a particular role.
LOW
Limited impact or a high barrier to exploitation.
Mapped to the control you're audited on
| Framework | Control | What the auditor sees |
|---|---|---|
| SOC 2 | CC4.1, CC7.1 | Independent security testing with findings, remediation and retest |
| ISO 27001 | A.8.8 | Identification and management of technical vulnerabilities |
| PCI DSS | 11.4 | Application-layer penetration testing with documented methodology |
| HIPAA | 164.308(a)(8) | Periodic technical evaluation of safeguards |
| OWASP | ASVS L1 · Top 10 | Coverage by verification category |
See The Standard applied to your app.
Scope in minutes and get a fixed quote.
One pentest standard for every customer you serve.
Every customer on a compliance automation platform eventually needs a pentest. Today, they're sent off to find one on their own and come back weeks later with evidence in a dozen different formats. We make the pentest control the easiest one to close.
One consistent standard
Every customer gets the same published methodology, the same report format and the same severity rules, so evidence is predictable.
Fits audit timelines
Scoped in minutes, results in 24 hours. Customers stop stalling at the pentest step.
Audit-ready evidence
Report and signed attestation letter, mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls.
Partner program
Referral and reseller options, co-marketing, and a predictable unit you can package for your customers.
Let's talk
Tell us a little about your platform or firm and we'll be in touch within one business day.
Prefer email? partner@standardpentest.com
Sample · Standard Pentest report · illustrative
acme-app.com security assessment
Tested 112 of 112 endpoints · The Standard v1 (OWASP ASVS L1) · Reviewed and signed by a security engineerExecutive summary
Testing found one high-severity issue: logged-in users could read other customers' invoices. Fixing this should be the priority before your audit. The three medium issues are routine to fix. Once fixes are in, request your retest and your attestation letter will show all findings as resolved.
0Critical
1High
3Medium
1Low
We're making pentesting standard.
Compliance frameworks, cyber insurers and enterprise customers all require penetration tests. But there's never been a standard for what a pentest is, and the industry has had little reason to create one: when revenue is tied to billable hours, efficiency isn't the goal.
That left small and mid-sized businesses stuck. They need a pentest to close deals and pass audits, but the market sold them enterprise-sized engagements at enterprise prices, with no way to tell what they were actually getting.
We built Standard Pentest to fix that. Specialized AI agents handle the repetitive, hours-heavy work of testing. Experienced security engineers review every finding and sign every report. And because every test follows a published standard, the results are consistent, comparable and measurable over time.
Compliance was once a manual, inefficient process too, until automation changed it. We think pentesting is next.