Pentest · AI-fast, human-proven
External: everything you expose to the internet, seen the way an attacker sees it. Internal: how far an attacker could get after one machine inside is compromised.
External network pentest
Everything you expose to the internet, seen the way an attacker sees it: hosts, services, admin panels and remote access.
Method: PTESOWASP WSTG (for web services found)
Internal network pentest
What an attacker could reach after a laptop or server inside your network is compromised, and how far they could move from there.
Method: PTESMITRE ATT&CK (for the paths found)
What you get
See a sample report, or verify a letter.
How it runs
1
A free 30-minute call, then one fixed price in writing within a working day. Nothing is tested before you sign an authorization.
2
Our tools and AI agents map every endpoint, role and AI feature in scope, and flag what looks wrong. Fast and wide.
3
A tester confirms each lead by hand, tests what AI misses (authorization, tenants and business logic) and records the evidence.
4
A report and letter signed by Subcloak, a readout with your engineers, and a free retest once you've fixed things.
FAQ
Something else? Email hello@subcloak.com or book a call.
A report signed by Subcloak with the scope, dates, method and every finding: evidence, severity and a fix. A free retest once you've fixed things, and a letter your customers and auditors can verify on our site.
After a free 30-minute call about the scope, you get one fixed price in writing within a working day. The price you sign is the price you pay.
By default we test staging or test accounts. If production has to be in scope, we agree limits in writing first: rate, time windows and anything that's off limits. Nothing is tested before you sign an authorization.
It produces a signed pentest report you can give your auditor. If you're preparing for SOC 2 or a large customer's review, the Proof Pentest adds a role-by-role authorization matrix and a report mapped to the controls.
Other tests
AI coverage plus a role-by-role authorization matrix and a report mapped to SOC 2 and ISO 27001.
Web application pentest API pentest Mobile app pentest Cloud configuration review Secure code review
For SOC 2, ISO 27001 and enterprise deals
AI covers your whole web app and API in days. Then a person tests every role and tenant by hand, proves each finding, and signs the report your auditor and customers will accept.
$4,900–9,500≈€4,400–8,500≈£3,700–7,200≈CA$7,000–13,500≈A$7,000–13,600≈S$6,300–12,200≈AED 18,000–34,900from ₹95,000
Report in 5 working days
Thirty minutes, no slides. Tell us what you need tested and when you need the report. You'll have one fixed price in writing within a working day.