Test the software and AI workflows your enterprise customers rely on. Get scoped findings, remediation evidence, and clear triggers for renewed testing.
Make roles and tenants explicit.
Test the agreed boundaries.
Evidence tied to the product your customer is buying.
Follow the data.
Validate the authority.
Test what an agent can access, remember, and do.
For CTOs and engineering or security leads with a customer pentest request. Confirm the reviewer, report criteria, product scope, and evidence deadline before testing.
For product and engineering teams whose production AI can read sensitive information or perform consequential actions. Test the full workflow and its permission boundaries.
Clarify one unclear buyer requirement. Get an evidence summary, prioritized gaps, owners, and an action plan that stands on its own.
Meet a defined pentest requirement with manual web, API, authorization, business-logic, and tenant-boundary testing.
Test how production AI reads sensitive data and takes action across retrieval, agents, MCP, tools, memory, and permissions.
All prices in USD, exclusive of taxes and fees.
After a baseline assessment, plan repeat testing when model, tool, data, or permission changes create identifiable review work.
Explore Continuous AI AssuranceIndependent SaaS and AI testing for GRC, vCISO, and product partners, with agreed report standards, scheduling, and client ownership.
Explore Security PartnerComplete a scoped assessment. Record the roles, tenants, workflows, permissions, tested versions, and remediation priorities.
Use the baseline and planned releases to identify repeat work. A stable system may need targeted follow-up instead of an annual plan.
For an agreed recurring plan, link change reviews and regression tests to versions, fixes, and the next reassessment.
Keep ownership of the SOC 2, ISO, or GRC program. Agree report quality, review steps, delivery dates, and retest responsibilities for each authorized client. Explore compliance partnerships ↗
Plan independent testing before client handoff. Confirm project volume, scope, client ownership, and how findings return to the engineers implementing fixes. Explore agency partnerships ↗
Agree assets, roles, tenants, environments, test windows, exclusions, stop conditions, and escalation contacts before access.
Agree confidentiality, authorized data, evidence sharing, approved tooling, access handling, and retention requirements during scoping.
A coverage matrix, buyer evidence summary, reproducible findings, and scoped fix verification. Agree report requirements and engineering workshop time before delivery.
Define application scope, tenant boundaries, pricing, and evidence.
Connect prompts, RAG, memory, identity, and tools to test objectives.
Define the host, server, tool, and authorization boundaries that matter.
We work best with a named engineering or security owner, a defined system, and a buyer requirement or material risk. Our focus is SaaS and production AI; we also accept suitable work across industries and through GRC, vCISO, and product partners. We confirm expertise, budget, authorization, and sector requirements during scoping.
Share the system, buyer requirement, reviewer, and deadline in a short scoping conversation. If the required testing is clear, we scope it directly. The $2,500 Security Gate Sprint is a paid review for an unclear procurement request; it is not a prerequisite for testing.
AI Application & Agent Security Assessment has a starting engagement range of $12,000–$20,000 USD, depending on scope. Workflows, model/provider boundaries, tools, MCP servers, roles, memory, and tenants determine the quote. Expanded engagements can exceed that range.
Start with a baseline assessment and review the findings, release cadence, and next-quarter changes. Where recurring work is justified, an annual plan defines quarterly testing, change and permission reviews, a versioned regression record, questionnaire support, and annual reassessment. Capacity and response windows are agreed in writing.
Share your product, buyer requirement, and target date. We’ll confirm the engagement, deliverables, and commercial terms before work begins.