Security That Fits
Where You Are
Published starting prices for every service, plus autonomous testing from Lory billed by the credit. Free retesting and portal access on every engagement.
Published Pricing
Free Retesting
No Hidden Fees
Client Portal Access
Auditor-Ready Reports
Talon PTaaS
Continuous Pentesting with Talon PTaaS
Replace once-a-year static PDF audits with continuous offensive validation, real-time finding telemetry, and auditor-accepted attestation letters. Transparent annual programs scoped for modern engineering teams.
Essentials
Continuous autonomous penetration testing for fast-shipping engineering teams
$165/month
$1,999 billed annually
- 250 Lory Credits / Month Included
- Autonomous Web, API & Network Testing
- Real-Time Finding Dossiers & Reproduction Steps
- Unlimited 1-Click Retest Verifications
- Talon MCP Server — Cursor & Claude Code IDE Sync
- Bi-Directional Jira & GitHub Issue Tracker Sync
- Auditor-Ready SOC 2 & ISO 27001 Readiness Summary
- Standard Email & Ticket Support
Most Popular
Professional
Annual penetration testing paired with continuous AI testing
$499/month
$5,999 billed annually
- 1x Annual Pentest Included — 2 Assets
- Scoped for Web Apps, APIs, Cloud/Kubernetes, Networks, or Code Review
- 750 Lory Credits / Month Included
- Autonomous Lory AI Testing Between Assessments
- Unlimited 1-Click Retest Verifications
- Auditor-Ready SOC 2, ISO 27001 & PCI Attestations
- Talon MCP Server — Cursor & Claude Code IDE Sync
- Bi-Directional Jira & GitHub Issue Tracker Sync
- Dedicated Lead Security Engineer & Slack/Teams Channel
Enterprise
Multi-target continuous offensive coverage with custom SLAs and advisory
$830/month
$9,999 billed annually
- 2x Annual Pentests Included — 5 Assets
- Full Scope: Web, API, Mobile, Cloud, Active Directory, AI/LLMs, Code Review (VCS), Thick Client & IoT
- 1,500 Lory Credits / Month Included
- Continuous Autonomous AI Testing
- Lory Mesh Private Subnet Connector
- Priority 24-Hour Retest Verification SLA
- Multi-Framework Attestation — SOC 2, ISO, HIPAA, PCI DSS
- Hands-on Remediation Consultation
- Bi-Directional Jira & GitHub Issue Tracker Sync
- Dedicated Lead Security Advisor & Executive Reviews
Need custom asset volume or portfolio-wide coverage? Talon PTaaS Enterprise Custom scales to multi-tenant architectures, holding companies, and VC portfolios. Contact us for custom scoping →
Calculate Your Total Pentest ROI & Engineering Savings
Model your exact multi-target estate — Web Apps, APIs, Mobile, Cloud/VPCs, Networks & Active Directory, AI Agents & LLMs, Source Repos (VCS), Thick Clients, and Hardware — to quantify direct vendor spend reduction and engineering hours reclaimed with Talon PTaaS.
Web & API
iOS / Android
Cloud & VPC
Network & AD
AI Agents
VCS Code Repos
Thick Clients
IoT & Hardware
Web Apps & APIs
2 Assets
Mobile Apps (iOS/Android)
0 Apps
Cloud & VPC / K8s
1 VPCs
Network & Active Directory
0 Subnets
AI Agents & LLM Systems
0 Models
Code Repos & CI/CD (VCS)
0 Repos
Thick Client & Desktop
0 Clients
IoT, Hardware & Kiosks
0 Units
Annual Assessment Frequency
Traditional Pentest Firm
$31,820/yr
Includes $2,500/retest fee • $5,320 engineering triage burden • 3–4 weeks delay
Talon PTaaS + Lory AI
Recommended
$5,999/yr
Recommended: Professional Plan • 72hr turnaround • Unlimited 1-click retests included
Direct Cash Saved
$20,501 / yr
Net vendor consulting spend eliminated
Engineering Reclaimed
56 hrs / yr
$5,320 in developer bandwidth ($95/hr)
Turnaround Velocity
~9 Weeks
72h SLA vs 6–9wk firm lag
Retest Penalties
$0 (Saved $2,500)
Unlimited 1-click retests included
Research & Benchmark Methodology: Engineering savings modeled from Dr. Chenxi Wang's PTaaS benchmark study (69 min/vuln triage reduction, 30 hrs reproduction saved per test via Replay Packs) at a loaded tech talent rate of $95/hr. Traditional consulting fees benchmarked across industry rate cards: $8,500/web app, $10,500/mobile app, $7,000/cloud env, $9,500/network & AD, $11,000/AI agent, $6,500/source repo code review, $10,000/thick client, $12,500/IoT & hardware, and $2,500/retest round.
Lory AI Pentester
Autonomous Testing, Priced by the Credit
Lory runs scoped engagements against your assets on her own and every finding is human-reviewed before it reaches you. $1 buys 1 credit — she draws from your balance as she works, so nothing starts that you haven't funded.
Hunter
Targeted code review scans and automated security fixes.
$25/month
25 credits land in your wallet
- 25 credits every month — renews monthly
- Targeted code review scans for repositories
- Up to 12 one-click security fix pull requests
- Unused credits roll forward — they never expire
Recon
One asset kept under standing review.
$250/month
275 credits land in your wallet
- 275 credits every month — $25 free
- At least 1 standard engagement, typically 3
- Or ~13 surface sweeps across your estate
- Unused credits roll forward — they never expire
Most Popular
Operator
Continuous coverage across a real production estate.
$1,000/month
1,150 credits land in your wallet
- 1,150 credits every month — $150 free
- At least 5 standard engagements, typically 14
- Headroom for MCP agent traffic on top
- Unused credits roll forward — they never expire
Continuous
Always-on testing with deep-depth headroom.
$2,500/month
3,000 credits land in your wallet
- 3,000 credits every month — $500 free
- At least 2 deep engagements, typically 6
- Or ~37 standard engagements per month
- Unused credits roll forward — they never expire
$1 = 1 credit
No seats, no licences
Credits never expire
Pay as you go from $25
Every finding human-reviewed
Metered Rates
Off-plan or over your monthly credits, this is what Lory charges. Same rates on every plan.
MCP RPC call
Every tool call your agents make through an MCP token — findings, KB lookups, scope checks.
0.1 crper call
Engine tokens
Input + output tokens Lory burns reasoning about your target during an engagement.
0.02 crper 1,000 tokens
Scanner compute
Wall-clock time in the sandboxed toolbelt — port scans, nuclei, fingerprinting, screenshots.
0.1 crper minute
Cost per Engagement
Engagements bill by depth. “Typical” is what a real run costs; “max” is the hard budget ceiling the engine will not exceed.
Surface
Recon sweep and the obvious attack surface.
~$21max $57
Standard
Full vector plan, the default for a scoped asset.
~$81max $223
Deep
Exhaustive — chained exploitation, long-running tooling.
~$501max $1,380
Lory is included directly in all Talon PTaaS annual programs above. See how Lory works →
Rate Card
What We Do, and What It Costs
Prices are the starting point for a typical scope — more endpoints, roles, or integrations move it up. Every test includes free retesting once you have remediated.
A controlled attack against your systems, run by people, so you find the holes before someone else does. Every test ends in a report you can hand to an engineer and a round of free retesting once you have fixed things.
| Service | Starting at | Typical window | Details |
|---|---|---|---|
| Web Application Pentest OWASP Top 10, business logic, auth and session handling | $9,500 | 1–2 weeks | Details |
| API Penetration Testing REST, GraphQL and gRPC against the OWASP API Top 10 | $8,500 | 1–2 weeks | Details |
| Network & Infrastructure Internal and external, credential and relay attacks, lateral movement | $8,000 | 1–3 weeks | Details |
| Cloud Pentesting AWS, Azure and GCP — IAM, storage, serverless | $12,000 | 2–3 weeks | Details |
| Mobile App Pentest iOS and Android against OWASP MASVS, plus runtime manipulation | $10,500 | 1–2 weeks | Details |
| Active Directory Domain escalation, Kerberoasting, BloodHound attack paths | $12,500 | 2–3 weeks | Details |
| Container & Kubernetes Escapes, RBAC, admission control, supply chain | $9,500 | 1–2 weeks | Details |
| AI Agent & LLM Pentest Prompt injection, tool abuse, data exfiltration through agents | $11,000 | 1–2 weeks | Details |
| Security Code Review Manual review over the whole codebase, plus SAST triage | $6,500 | 3–5 days | Details |
| Vibe Coding Review For apps an AI wrote — the failure modes models reliably ship | $4,500 | 2–5 days | Details |
| Desktop Application Thick clients — binary analysis, IPC, local privilege | $10,000 | 1–2 weeks | Details |
| Wireless Pentesting Rogue AP, WPA2/3 attacks, guest network segmentation | $5,500 | 3–5 days | Details |
| Social Engineering Pretext calls, physical tailgating, targeted campaigns | $7,500 | 2–4 weeks | Details |
| Phishing Simulation Campaigns against your staff, with who-clicked-what reporting | $3,500 | 1–2 weeks | Details |
| Physical Pentesting Badge cloning, lock bypass, and what happens once we are in | $9,500 | 1–2 weeks | Details |
| IoT & Hardware Firmware extraction, UART/JTAG/SPI, wireless protocols | $16,000 | 2–4 weeks | Details |
| Smart Contract Audit Web3 and DeFi — economic attacks, flash loans, code review | $15,000 | 1–3 weeks | Details |
| ATM & Banking Terminal Physical security, firmware, PCI PTS, skimming | $15,000 | 2–3 weeks | Details |
| Vending & Kiosk Unattended terminals — payment path, tamper, network pivot | $12,000 | 1–2 weeks | Details |
| Red Team Operations Full adversary simulation, physical and digital, custom TTPs | $35,000 | 4–8 weeks | Details |
| Vulnerability Scanning Authenticated and unauthenticated sweeps, triaged by a human | $250/scan | 1–2 days | Details |
| Retesting & Validation We re-run the test after you fix it and reissue the report | Included | After remediation | Details |
There is no such thing as a “SOC 2 pentest” — it is one pentest, scoped and reported so your auditor accepts it as evidence. We map the same engagement to whichever framework you are being held to, and cover the rest of the readiness work around it.
Reported against
SOC 2
ISO 27001
PCI-DSS
HIPAA
CMMC
FedRAMP
HITRUST
GDPR
NIST CSF
NIS2
DORA
SOX
GLBA
CCPA/CPRA
CIS
CASA/MASA
| Service | Starting at | Typical window | Details |
|---|---|---|---|
| Compliance-Scoped Pentest One pentest, reported against the framework your auditor uses | $8,500 | 1–2 weeks | Details |
| Federal & Defense Scope FedRAMP and CMMC — heavier control set, 3PAO-aligned evidence | $18,000 | 3–4 weeks | Details |
| Gap Assessment Where you stand against the framework, control by control | $6,500 | 1–2 weeks | Details |
| Policies & Procedures Written for your business, not lifted from a template pack | $4,500 | 1–2 weeks | Details |
| Evidence & Audit Support We collect the artifacts and answer the auditor directly | $5,500 | Through the audit | Details |
| Access Reviews User entitlements, least-privilege gaps, stale accounts | $3,500 | 2–5 days | Details |
| Findings Remediation Our engineers fix the findings rather than hand them over | $4,000 | 1–2 weeks | Details |
| vCISO / Security Retainer A named security lead on your leadership calls | $4,000/month | Ongoing | Details |
| Security Advisory Architecture reviews and design calls, billed by the hour | $350/hour | On demand | Details |
| VC Due Diligence Security posture review before you write or take the cheque | $7,500 | 1 week | Details |
Testing tells you where you are weak. This is the half that watches the estate the rest of the year, and the number you call at 2am when something has already gone wrong.
| Service | Starting at | Typical window | Details |
|---|---|---|---|
| Managed Detection & Response Our analysts watch your alerts and act on them, 24/7 | $2,800/month | Ongoing | Details |
| SOC as a Service A full security operations centre without hiring one | $3,500/month | Ongoing | Details |
| 24/7 Continuous Monitoring Always-on coverage across endpoints, cloud and network | $2,200/month | Ongoing | Details |
| SIEM Management Log pipeline, detection rules, and tuning that keeps up | $1,800/month | Ongoing | Details |
| EDR / XDR Endpoint agent rollout, policy, and day-to-day management | $1,100/month | Ongoing | Details |
| Incident Response Retainer Guaranteed response time and hours banked before you need them | $1,500/month | Ongoing | Details |
| Ransomware Response Containment, eradication, and getting the business back up | $25,000 | Immediate | Details |
| BEC Response Mailbox compromise — scope it, evict them, prove it is over | $8,500 | 3–5 days | Details |
| Digital Forensics Defensible imaging and analysis that holds up in a dispute | $12,000 | 1–3 weeks | Details |
| Log Analysis & Review Reconstruct what happened from the evidence you kept | $6,000 | 1–2 weeks | Details |
| Threat Hunting Hypothesis-led hunts for what your tooling did not flag | $4,500 | 1–2 weeks | Details |
| Purple Team We attack, your defenders watch, and the detections improve | $18,000 | 2–3 weeks | Details |
| Tabletop Exercise Walk your leadership through a breach before it is real | $6,500 | 1–2 days | Details |
| Threat Intelligence What is being used against your sector, filtered to you | $1,200/month | Ongoing | Details |
| Dark Web Monitoring Your credentials and data, watched where they get traded | $650/month | Ongoing | Details |
| Vulnerability Management Continuous scanning and prioritised remediation, SLA-backed | $1,200/month | Ongoing | Details |
| Patch Management Risk-based deployment with a rollback path | $950/month | Ongoing | Details |
| Email Security SPF, DKIM, DMARC and the gateway rules that stop the rest | $850/month | Ongoing | Details |
| Endpoint Protection Hardening and managed AV/EPP across the fleet | $900/month | Ongoing | Details |
| Network Security Firewall, segmentation and egress control, managed | $1,400/month | Ongoing | Details |
| Zero Trust Implementation Identity-first architecture, rolled out in stages | $15,000 | 4–8 weeks | Details |
Lory runs scoped engagements against your assets on her own, and a human reviews every finding before it reaches you. Billed by the credit — $1 buys 1 credit, and nothing starts that you have not funded.
| Service | Starting at | Typical window | Details |
|---|---|---|---|
| Lory Hunter Targeted code review scans and automated security fixes. 25 credits a month. | $25/month | Ongoing | Details |
| Lory Recon One asset kept under standing review. 275 credits a month. | $250/month | Ongoing | Details |
| Lory Operator Continuous coverage across a real production estate. 1,150 credits a month. | $1,000/month | Ongoing | Details |
| Lory Continuous Always-on testing with deep-depth headroom. 3,000 credits a month. | $2,500/month | Ongoing | Details |
| Lory Credits No plan and no seats — load a balance and Lory draws from it as she works | $1/credit | $25 – $25,000 | Details |
Scoping
What Affects Pricing?
Every engagement is scoped individually based on your environment. Here's what we look at.
Scope & Complexity
Number of endpoints, user roles, integrations, and application size directly affect testing time and cost.
Testing Approach
Black box (no access), gray box (partial), or white box (full source) — each requires different effort.
Compliance Requirements
SOC 2, PCI-DSS, HIPAA, and other frameworks require additional testing controls and specialized reporting.
FAQ
Pricing FAQ
How much does a penetration test cost?
A web application pentest starts at $9,500, network and infrastructure at $8,000, and a compliance-scoped pentest at $8,500. The starting price covers a typical single-application or single-environment scope; more endpoints, user roles, integrations, or compliance requirements move it up. Every service on this page shows its starting price, and a free scoping call turns that into an exact quote.
Is there such a thing as a “SOC 2 pentest”?
Not really, and we would rather say so. SOC 2 does not mandate a penetration test by name — your auditor asks for evidence that you test your systems, and a pentest is how you produce it. The engagement is the same one we would run anyway; what changes is the scoping and the report, which we map to the Trust Services Criteria, or ISO Annex A, or PCI requirement 11.4, or whichever framework you are being held to. That is why the rate card carries one compliance-scoped pentest at $8,500 rather than a dozen framework-branded products at a dozen prices. FedRAMP and CMMC are the real exceptions — the control set is genuinely heavier, so they are priced separately.
Is retesting included?
Yes. All penetration testing engagements include one round of free retesting after you remediate the findings. This ensures your fixes work and gives you a clean report for compliance or stakeholders.
Do you offer Talon PTaaS annual programs?
Yes. Talon PTaaS annual programs are available across three tiers: Essentials at $1,999/year, Professional at $5,999/year, and Enterprise at $9,999/year, each billed annually. Every paid plan includes a monthly credit allowance — 250/mo on Essentials, 750/mo on Professional, 1,500/mo on Enterprise — to fund autonomous Lory AI testing, plus unlimited 1-click retest verifications. Professional includes 1x annual pentest covering up to 2 assets: Web Apps, APIs, Cloud/Kubernetes, Networks, or Code Review. Enterprise includes 2x annual pentests covering up to 5 assets across our full scope: Web, Mobile, Cloud, Active Directory, AI Agents, Code Review (VCS), Thick Client, and IoT.
Is Talon free to use?
Yes! Creating a Talon workspace is 100% free with no credit card required. On the Free tier, you can log in to view your past assessment reports, manage findings, and integrate your IDE via the Talon MCP Server. Autonomous Lory AI scans can be launched anytime using pay-as-you-go credits, or you can subscribe to a Talon annual plan to receive your monthly allowance.
What's included in compliance automation integration?
Talon integrates with Vanta, Drata, and continuous compliance platforms to stream real-time test evidence, remediation verification, and formal attestation letters directly into your auditor's control console. Contact us for scoping and integration setup.
How is Lory AI Pentester priced?
By the credit, where $1 buys 1 credit. Lory draws down as she works — 0.1 credit per MCP tool call, and engagements billed by depth (a typical standard engagement runs about $81, a deep one about $501). Monthly plans start at $25/month for 25 credits with Hunter (ideal for code review scans & fixes), with higher tiers adding bonus credits every month. Credits never expire, so an unused month rolls forward. You can also pay as you go from $25 with no plan at all.
Can Lory replace a human pentest?
No — they do different jobs. Lory gives you continuous coverage between engagements at a fraction of the cost, and every finding she reports is reviewed by one of our testers before it reaches you. A scheduled human pentest is still what you want for business logic, chained exploitation, and an auditor-facing report. Most clients run both, which is why Lory is bundled directly into our Talon PTaaS annual programs.
What do I get in the report?
Every engagement delivers an executive summary, detailed technical findings with CVSS scores, proof-of-concept exploits, step-by-step reproduction instructions, prioritized remediation guidance, and compliance mapping. Formatted for both technical teams and executive stakeholders.
How quickly can you start?
Typical lead time is 1-2 weeks from scoping to kickoff. For urgent engagements (compliance deadlines, insurance requirements, pre-launch testing), we can often accommodate faster timelines.
Ready to Get Started?
Book a free scoping call to talk through your needs with a security engineer and get a custom quote.
Not sure which service fits?
Ask Lory — our AI assistant knows every service and can help you find the right fit. Get instant answers.
