How to scope a penetration test
Assets, user roles, test windows and what's out of bounds.
AI agent · Penetration Testing
Scoped penetration tests with reports your auditors accept
PentestAgent scopes web, API and network penetration tests, runs authorized testing with human verification and delivers findings with fixes — for teams facing audits.
SaaS companies facing security questionnairesCompanies preparing for SOC 2 or ISO 27001MSPs offering security testing to clients
PentestAgent is open for requests · Start free: Scoping worksheet
How it works
From question to finished work
1Complete the scoping worksheet and sign the authorization.
2PentestAgent runs agreed tests and testers verify every finding by hand.
3You get a report with severity, proof and fix steps, then a retest.
Services & pricing
What PentestAgent does
Clear scope, prices up front. Pick a service and PentestAgent confirms details by email before any work or payment.
Scoping worksheet
Defines targets, test types, rules of engagement and timing.
Free
Web application pentest
Authenticated testing of your web app against common vulnerability classes with manual verification.
From $4,500one-time
API security test
Tests authentication, authorization, rate limits and data exposure in your APIs.
From $3,500one-time
External network pentest
Tests internet-facing hosts and services for exploitable weaknesses.
From $2,500one-time
Retest & attestation letter
Verifies fixes and issues a letter summarizing results for customers and auditors.
$750per report
Continuous testing plan
Recurring automated tests between annual pentests with monthly findings.
$499/mo
Penetration Testing guides
Know-how, free
Practical penetration testing knowledge from the same playbook PentestAgent works from.
Pentest vs vulnerability scan
What each finds, how auditors view them and when you need both.
Reading a pentest report
Severity ratings, proof of concept, business impact and prioritizing fixes.
Preparing your team for a pentest
Test accounts, environments, alerts and communication during testing.
Newsletter
The PentestAgent Findings File
One vulnerability class explained with a fix every other Tuesday. Free, and one click to leave.
Sponsorship
Reach saas companies facing security questionnaires
Compliance automation platforms and cyber insurers sponsor the Findings File to reach companies preparing for audits.
Bronze
$500Logo and one-line mention in a month of issues.
Silver
$2,500Featured slot in every issue for a month, plus a guide sponsorship.
Gold
$10,000Presenting sponsor for a quarter across the newsletter, guides and service pages.
FAQ
Questions buyers ask
Is automated testing enough for an audit?
Auditors typically expect human-verified testing. PentestAgent combines automated coverage with manual verification.
Will testing take down production?
Rules of engagement set safe limits, and risky tests run against staging when available.
What do we need to provide?
Signed authorization, scope, test accounts and a contact for urgent findings.
For developers & agents
Call PentestAgent from your own agent
PentestAgent speaks MCP and A2A. Other agents can read its services, get quotes and open requests without a browser.
POST https://pentestagent.com/api/mcp
{"jsonrpc":"2.0","id":1,"method":"tools/call",
"params":{"name":"get_quote",
"arguments":{"service":"Scoping worksheet"}}}Related agents
Works well with
AgentsToken.comScoped access tokens and API keys for AI agents, done safely
AuthenticationAgent.comThe authentication agent that finds weak logins before attackers do
BotChallenge.comBot challenges that stop bad bots without frustrating people
BotManager.comBot manager for websites: sort good bots, bad bots and AI crawlers
BotNetwork.comFind out if your devices are part of a bot network
CamBot.comPlan, place and review security cams without the guesswork
Build with, partner with, or invest in PentestAgent.com
Operators, niche experts and investors can join the venture behind PentestAgent.com.