Skip to content
subcloak
Book a test

Pentest · AI-fast, human-proven

Web application pentest, proved by hand.

Your web app tested by hand for authentication, access control and business-logic flaws, with AI covering the rest of the surface fast.

Book a test What we test

What we test

What we test.

  • Sign-in, sessions, password reset and multi-factor flows
  • Access control between roles and tenants, request by request
  • Business logic: prices, limits, approvals and workflows
  • Injection, XSS, SSRF, file upload and the rest of the OWASP Top 10
  • OAuth, OIDC, SAML and JWT handling

Method: OWASP Top 10OWASP WSTG

What you get

  • AI-fast, human-proven: AI covers the surface in days, a person proves every finding
  • A signed report with evidence, severity and a fix for each finding
  • A free retest of your fixes, and a letter your customers can verify

See a sample report, or verify a letter.

How it runs

Four steps, one fixed price.

  1. 1

    Scope and sign

    A free 30-minute call, then one fixed price in writing within a working day. Nothing is tested before you sign an authorization.

  2. 2

    AI covers everything

    Our tools and AI agents map every endpoint, role and AI feature in scope, and flag what looks wrong. Fast and wide.

  3. 3

    A person proves it

    A tester confirms each lead by hand, tests what AI misses (authorization, tenants and business logic) and records the evidence.

  4. 4

    Signed report, then retest

    A report and letter signed by Subcloak, a readout with your engineers, and a free retest once you've fixed things.

FAQ

Pentest questions

Something else? Email hello@subcloak.com or book a call.

What do we get at the end?

A report signed by Subcloak with the scope, dates, method and every finding: evidence, severity and a fix. A free retest once you've fixed things, and a letter your customers and auditors can verify on our site.

How is the price set?

It starts from the price on this page and is fixed after a free 30-minute call, once we know the scope. The price you sign is the price you pay.

Do you need production access?

By default we test staging or test accounts. If production has to be in scope, we agree limits in writing first: rate, time windows and anything that's off limits. Nothing is tested before you sign an authorization.

Does it count for SOC 2 or ISO 27001?

It produces a signed pentest report you can give your auditor. If you're preparing for SOC 2 or a large customer's review, the Proof Pentest adds a role-by-role authorization matrix and a report mapped to the controls.

Other tests

For SOC 2 or a big customer, the Proof Pentest.

AI coverage plus a role-by-role authorization matrix and a report mapped to SOC 2 and ISO 27001.

API pentest Mobile app pentest Network pentests Cloud configuration review Secure code review

For SOC 2, ISO 27001 and enterprise deals

Proof Pentest

AI covers your whole web app and API in days. Then a person tests every role and tenant by hand, proves each finding, and signs the report your auditor and customers will accept.

$4,900–9,500≈€4,400–8,500≈£3,700–7,200≈CA$7,000–13,500≈A$7,000–13,600≈S$6,300–12,200≈AED 18,000–34,900from ₹95,000

Report in 5 working days

Get a test you can stand behind.

Thirty minutes, no slides. Tell us what you need tested and when you need the report. You'll have one fixed price in writing within a working day.

Book a test hello@subcloak.com