Enterprise deals and audits
A recent, independent pentest is a standard requirement to close enterprise deals and pass audits. Our reports are built to hand to auditors and procurement teams.
Pentesting & PTaaS · Web · API · AEC/BIM
We find what scanners miss.
Manual penetration testing of web applications and APIs for SaaS companies and engineering & construction firms. Business logic, user-to-user authorization and data exposure, with a fix for every finding and a retest included. Reports in English, other languages on request.
75–80%of the work is manual
12–48 hcritical finding response
PTaaScontinuous pentesting from USD 690/mo
OWASP · CVSSstandard, verifiable methodology
Why us
Senior-level testing, built for real audits.
Manual depth, clear evidence and fixed prices that make sense for growing teams.
Privacy and security regulation
Data-protection and operational-resilience rules expect appropriate, tested security measures. A pentest generates evidence of what you tested and what you fixed. It does not certify compliance on its own.
Async-friendly, with one technical lead
Fully remote engagements with an assigned technical lead, written updates during testing and a debrief call. Reports in English, other languages on request.
AEC / BIM specialists
Your drawings and models are sensitive data too.
A construction project shares drawings, models and access with dozens of companies. We review how that information flows and where it leaks, with tests designed for how a real project works.
Project portals
Access control by role, by project and by subcontractor.
CDE
Configuration of Trimble Connect, Autodesk Construction Cloud and similar platforms.
Subcontractors and external users
Accounts still active after the project ends, inherited permissions and shared links.
Drawings and models
RVT, IFC, DWG and PDF files exposed outside the authorized group.
What makes us different
Not a scanner with a logo.
The vulnerabilities that hurt the most live in your application's logic, and only a person finds those.
01
Real manual testing
75–80% of the work is manual: business logic, IDOR across users and tenants, authentication and authorization.
02
Audit-ready reports
Technical report plus executive summary, mapped to OWASP, with clear remediation steps. In English, other languages on request.
03
Human-led, AI-assisted
We use tooling and AI-assisted reconnaissance so we can spend more hours on what matters. A person confirms every finding, and customer data is not submitted to public third-party LLM services.
04
Measurable commitments
Critical findings reported within 12 to 48 hours depending on the plan; if we miss it, the next month is free. Every finding comes with its fix, and we close with a retest letter showing the final status.
Continuous pentesting (PTaaS)
Security that keeps up with every release.
Monthly subscription in USD, 12-month contract, unlimited retests. Each plan combines two different things, and we always tell you which is which.
Human pentestingA person tests your application in depth: business logic, user-to-user authorization, authentication. This is where serious findings show up.
Automated monitoringBetween pentests, tools watch your external surface and scan the app. A person removes false positives before alerting you.
STARTER
690 USD/mo
1 app or API · USD 8,280 per year
Human pentesting
- 1 manual pentest per year
- Critical findings reported within 48 h
Automated monitoring
- Monthly scan with manual triage
- External surface: monthly
GROWTH
1,490 USD/mo
Up to 3 apps or APIs · USD 14,900 paid annually
Human pentesting
- 2 manual pentests per year
- Release testing (4 days per year)
- Critical findings reported within 24 h
- Annual compliance report
Automated monitoring
- Monthly scan with manual triage
- External surface: weekly
- Findings sent to Jira, Slack or GitHub
SCALE
2,900 USD/mo
Up to 6 apps or APIs · USD 34,800 per year
Human pentesting
- Quarterly manual pentest
- Release testing (8 days per year)
- AI/LLM feature testing
- Critical findings reported within 12 h
- Compliance report with every pentest
Automated monitoring
- Monthly scan with manual triage
- External surface: weekly
- Findings sent to Jira, Slack or GitHub
Billed in USD
Annual payment: 2 months free
Extra asset: +USD 350/mo on Growth and Scale
If we miss a critical-finding SLA, the next month is free
One-off projects
Fixed price by scope.
All prices in USD. Every project includes a technical and executive report with a fix for every finding, and a retest within 60 days. See our AI offensive security services.
| Service | Testing | Price |
|---|---|---|
| SafeCheck — Vulnerability assessment1 web app or up to 3 IPs/domains. Reconnaissance, vulnerability and risk analysis validated by hand, no exploitation. Retest of critical and high findings; credited if you buy a pentest within 60 days. Details → | 2–3 days | 990 |
| SafePentest Essentials — Web App1 app, up to 2 user roles, standard authentication | 5 days | 2,900 |
| API PentestREST or GraphQL, up to 40 endpoints, authentication flows | 5–6 days | 3,400 |
| AEC Portal & CDE ReviewProject portal, CDE configuration, subcontractor access | 5 days | 3,900 |
| SafePentest Pro + APIBusiness logic, IDOR/BOLA, multi-tenant isolation, SSO/OAuth, REST and GraphQL, up to 40 endpoints. Details → | 8–10 days | 5,500 |
| SafePentest AdversaryAuthorized adversary emulation against a defined business objective. Details → | Custom quote | 8,000+ |
+ USD 800Compliance report: ISO 27001, SOC 2, PCI DSS and regional data-protection requirements
+ USD 1,500Assisted source code review (white box), per app
USD 600Additional retest outside the 60-day window
+ 25%Rush delivery, in under 10 business days
Methodology
Four steps, no surprises.
A standard, verifiable method, and a report your team can start fixing from the same day.
01
Scope and authorization
Contract, signed authorization letter and clear rules of engagement.
02
Manual testing
OWASP WSTG and API Security Top 10, plus your application's own business logic.
03
Report and call
Findings with evidence, CVSS severity and a remediation recommendation for each one.
04
Retest
We test again and deliver a retest letter with the final status of every finding.
What the report includes
- Executive summary with overall risk and the top 3 actions for the next 7 days.
- Detailed findings: location, evidence, impact and CVSS v3.1 score.
- A fix for every finding: a short, actionable recommendation, not just the problem.
- Remediation plan by priority (7, 30 and 60 days) with estimated effort.
- Retest letter with each finding marked as fixed, mitigated or open.
- Optional mapping to ISO 27001, SOC 2, PCI DSS and regional data-protection requirements.
- Location
GET /rest/basket/{id}- Description
- Using one customer's session, changing the
idreturns another customer's basket. The server does not check who owns the resource. - Impact
- Any customer's products and purchase data can be read: a personal data breach.
FixLoad the basket from the identity in the token, not from the parameter, and enforce ownership checks on every resource accessed by id.
Sample from a report on OWASP Juice Shop, an intentionally vulnerable lab application.
No test starts without a contract and written authorization. Evidence is encrypted and deleted after 90 days, and customer data is not submitted to public third-party LLM services as part of the assessment workflow.
Founders Program · 3 spots
A pilot pentest for USD 1,490 in exchange for a case study.
- Full Web App Essentials scope, retest included.
- If you subscribe to PTaaS within 30 days, the pilot is credited to your first month.
- Growth plan locked at USD 1,290/mo for the first year.
Valid until January 31, 2027.
Apply for a spotFree · 48 hours
External exposure diagnostic
See what an attacker sees of your company today, before it turns into an incident you have to report.
- Passive review of subdomains, certificates, security headers, exposed services and public leaks.
- A one-page summary with 5 prioritized findings, each with its fix.
- No exploitation traffic, and only with your written authorization.
What would an attacker find in your app today?
Tell us what you want tested and we'll send a proposal with scope and a fixed price.
Prefer email? contact@safepentest.com