01
Web app
Authentication, sessions, access control between roles and tenants, business logic, file handling and the OWASP Top 10.
SOC 2 + AI Pentest Sprint
The pentest your auditor asks for, including the AI parts.
A human-led pentest of one web app and its API, including any AI feature in it, with the report and letter your SOC 2 auditor asks for.
$3,400≈€3,000≈£2,600≈CA$4,800≈A$4,900≈S$4,400≈AED 12,500₹95,000
Fixed price · billed in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
Approximate, at 9 Oct 2026 rates · invoiced in USD
For clients in India · plus 18% GST
10 working days · rush +40%
Why “AI” is in the name
Automated pentests cover the usual. Your product isn't usual.
Compliance platforms now bundle automated pentests that catch common web issues. They tend to miss what's new in your product. The Sprint tests both, by hand.
CoverageAutomatedSprint
- OWASP Top 10 web issuesCovered by automated scansCovered by the Sprint
- Known CVEs and misconfigurationsCovered by automated scansCovered by the Sprint
- Business logic and multi-step abuseNot covered by automated scansCovered by the Sprint
- Access control between roles and tenantsNot covered by automated scansCovered by the Sprint
- Prompt injection through user contentNot covered by automated scansCovered by the Sprint
- What your AI assistant is allowed to doNot covered by automated scansCovered by the Sprint
- Personal data leaking into model contextNot covered by automated scansCovered by the Sprint
- Named tester, retest and attestation letterNot covered by automated scansCovered by the Sprint
What's in scope
One app. Three surfaces.
02
API
The REST or GraphQL endpoints behind the app: object-level authorization, mass assignment, rate limits and token handling.
03
AI features
Assistants, copilots and agents in the app: what they can reach, whether user content can steer them, and what they leak.
- Manual test of one web app, its API, and its AI features
- Findings mapped to SOC 2 and ISO 27001 controls
- Report your auditor can accept, plus a fix list
- One retest and an attestation letter
How it runs
Ten working days, start to report.
Rush delivery is +40%, when we have the capacity.
- 01
Day 0
Scope and sign
Fixed price, test plan and signed authorization before any testing.
- 02
Days 1–8
Manual testing
Authentication, access control, business logic, API and the AI features, tested by hand.
- 03
Day 9–10
Report and readout
Findings mapped to SOC 2 and ISO 27001, a fix list, and a call with your engineers.
- 04
Within 30 days
Retest and letter
We retest fixes and issue the attestation letter for your auditor and customers.
Compliance mapping
Findings your auditor can file.
Each finding lists the SOC 2 criteria and ISO 27001 controls it is relevant to, so the fix can be tracked against your controls.
| Finding type | SOC 2 | ISO 27001 |
|---|---|---|
Broken access control between tenants
| ||
Weak session handling
| ||
Prompt injection into the AI assistant
| ||
Personal data in model context or logs
| ||
Missing audit trail for admin actions
|
Attestation letter
One page your customers can verify.
Security questionnaires ask for proof of a recent pentest. The letter states what we tested, when, and the result after the retest. Each has an ID anyone can check on our verify page.
After the Sprint, Subcloak Watch ($900≈€800≈£680≈CA$1,300≈A$1,300≈S$1,200≈AED 3,300₹40,000 a month) keeps the result current between audits.
Letter ID SC-DEMO-0001 · Sample · not a real attestation
Attestation of security testing
- Client
- Fernhill Software (fictional)
- Scope
- fernhill-crm-mcp, hosted MCP server (staging), 6 tools, OAuth 2.1
- Window
- Illustrative 8-day engagement plus retest
- Method
- Agent Access Audit, 32 published checks
All critical and high findings were fixed and verified on retest. One medium and one low finding remain open with an agreed fix date, and the client accepted the risk of one medium finding.
This letter describes the system during the testing window. It is not a guarantee that no other vulnerabilities exist.
Lead tester
Named and signed on real letters
subcloak.com/verify
Is this a real manual pentest?
Yes. A person tests your app by hand. Scanners help with coverage, but every finding is confirmed and written up by the tester.
Why does it include AI features?
Compliance platforms now bundle automated pentests that cover the usual web issues. They tend to miss AI features: prompt injection, over-permissioned assistants and data leaking through model context. The Sprint covers both.
What if we need it faster?
Rush delivery in under 10 working days is +40%, if we have the capacity. Ask on the call.
What if our app is bigger than one app and one API?
We'll quote the extra scope on the call, as a fixed price. Larger scopes usually split into two sprints.
Got an audit date?
Tell us the date and what's in scope. We'll confirm on the call whether we can deliver before it, at a fixed price.