Frequently Asked Questions

Our engagements start at $1,500. Starting prices by service: vulnerability assessment $1,500; phishing simulation $2,000; web application and developer API $3,500; cloud security and PCI scanning $3,000; external penetration testing $3,500; LLM/AI penetration testing $4,500; internal penetration testing $5,000; mobile application $5,500; thick client applications $7,000; red teaming $8,000; IoT and embedded systems $10,000; EU AI Act cybersecurity assessment $10,000. See every starting price on our services page, or read our breakdown of what a penetration test costs.

Scope, not hours. The type of assessment sets the starting price. From there, the number of endpoints, user roles, IP addresses, and hosts in scope moves the number, along with whether testing is authenticated or unauthenticated and whether you need a compliance-driven scope such as PCI DSS, SOC 2, or HIPAA. We do not charge a rush premium — we can start most engagements within 24 hours at no extra cost.

Yes. Every engagement is quoted as a fixed price after a short scoping call — no hourly billing and no open-ended estimates. You know the number before testing starts. Request a quote and we'll have a scoped price back to you within 24 hours.

The test itself, a full findings report (executive summary for leadership, technical findings with CVSS risk scores, proof-of-concept demonstrations, and remediation guidance), a findings review call, and a complimentary retest within 30 days of the final report. You also get direct access to the senior tester doing the work, not an account manager relaying messages. There are no separate charges for deliverables, meetings, or report revisions.

Penetration testing (or pentesting) is a simulated cyber attack against your systems to identify security vulnerabilities before malicious hackers can exploit them. Our testers use the same techniques as real attackers to find weaknesses in your web applications, networks, and cloud infrastructure. We offer 21 penetration testing services tailored to your technology stack.

The duration depends on the scope and complexity of the assessment. A typical web application test takes 3-5 days, while larger engagements involving multiple applications or network testing may take 1-2 weeks. We'll provide a detailed timeline during the scoping process. Request a quote to get an exact timeline for your project.

We take a careful approach to minimize any impact on your systems. We coordinate timing with your team, avoid denial-of-service testing unless specifically requested, and maintain open communication throughout the engagement. Most tests — including web application, API, and external network assessments — have no noticeable impact on system performance.

Once contracts are signed and we have the necessary access, we can typically begin testing within 24 hours for most engagements. For larger or more complex assessments, we'll coordinate a start date that works for your team.

Every report includes an executive summary for leadership, detailed technical findings with CVSS risk scores, proof-of-concept demonstrations, step-by-step remediation guidance, and prioritized recommendations. Reports are written in clear language that both technical and non-technical stakeholders can understand.

Yes. Every engagement includes a complimentary retest within 30 days of the final report. This gives your team time to implement fixes, and we'll validate that vulnerabilities have been properly remediated.

Our testers hold industry-recognized certifications including OSCP (Offensive Security Certified Professional), OSWA (Offensive Security Web Assessor), CISSP, and CCSK. Each tester has a minimum of 5 years of hands-on offensive security experience. Learn more about our team.

We follow strict data handling protocols. Any sensitive data encountered during testing is documented only as necessary to demonstrate the vulnerability, never exfiltrated or stored beyond what's required for the report. All findings are encrypted and securely transmitted.

Absolutely. We sign NDAs and have strict confidentiality agreements as part of our standard engagement process. Your security findings and business information are always kept strictly confidential.

Yes. Article 15(5) of the EU AI Act explicitly requires that high-risk AI systems be resilient against attempts by unauthorised third parties to alter their use, outputs, or performance by exploiting system vulnerabilities, and Recital 77 names the specific attack categories — data poisoning, model poisoning, adversarial examples, confidentiality attacks, and model flaws. Article 9(8) further requires that testing be performed against pre-defined metrics before market placement. This is a technical security testing mandate written into EU law, not just a best practice. Our EU AI Act compliance testing service is built to satisfy these exact requirements. See also our LLM/AI penetration testing service.

Article 15 covers accuracy, robustness, and cybersecurity for high-risk AI systems. Article 15(1) sets the design-level mandate for an appropriate level of accuracy, robustness, and cybersecurity throughout the lifecycle. Article 15(4) requires resilience against errors, faults, and inconsistencies. Article 15(5) — the operative cybersecurity clause — requires resilience against unauthorised third parties attempting to alter a system's use, outputs, or performance by exploiting system vulnerabilities, with Recital 77 naming the specific attack categories: data poisoning, model poisoning, adversarial examples, confidentiality attacks, and model flaws. Conformity assessment evidence must demonstrate the system has been tested against these threats.

August 2, 2026 is the primary compliance deadline for Annex III high-risk AI systems under the EU AI Act. High-risk AI systems already on the market that have not been substantially modified have an extended deadline of August 2, 2027. AI embedded in safety-critical regulated products such as medical devices may qualify for a further extension to December 31, 2030. Prohibited AI practices have been banned since February 2, 2025, and GPAI governance requirements have applied since August 2, 2025.

Yes. The EU AI Act applies to any company — including US-based businesses — whose AI systems are deployed in the EU or affect EU residents. If you sell AI-powered software, SaaS products, or services to EU customers, or operate AI systems that process EU resident data, you are in scope. Non-EU providers of high-risk AI must appoint an EU authorized representative before placing their systems on the EU market. The fines apply regardless of where the company is headquartered.

EU AI Act fines are calculated as the greater of a fixed amount or a percentage of global annual turnover — whichever is higher. Prohibited AI practice violations carry fines up to €35 million or 7% of global annual turnover (exceeding GDPR's 4% maximum). High-risk system violations including Article 15 cybersecurity failures carry fines up to €15 million or 3%. Incorrect information supplied to authorities carries fines up to €7.5 million or 1%. Additional enforcement includes market withdrawal orders, suspension of deployment, product recall, and public naming.