# pentests.work — Full Details

> AI-powered security. Human-verified results.

pentests.work offers web application penetration testing powered by AI automation and verified by human security experts. A brand of Triton InfoSec (tritoninfosec.com).

## Service Overview

We perform comprehensive web application penetration tests that combine AI-guided testing with expert human verification. Unlike automated scanners that produce surface-level results with many false positives, our approach uses AI to handle time-consuming, repetitive tasks while human experts focus on deeper analysis — business logic flaws, authentication bypasses, and nuanced vulnerabilities that scanners miss.

### What You Get

- Executive summary for leadership and stakeholders
- Detailed findings with CVSS severity ratings
- Step-by-step reproduction instructions with screenshots
- Specific remediation guidance for each vulnerability
- Free re-testing after you fix the issues

### What We Need From You

- The URL of your application
- The scope (which areas to test)
- Test credentials if you want authenticated testing
- A brief questionnaire (about 5 minutes)

## Pricing

### Starter — $1,499
- Up to 30 pages / endpoints
- 1 user role
- OWASP Top 10 coverage
- 3-day turnaround
- PDF report with remediation guidance
- 1 free re-test (30 days)

### Professional — $2,999
- Up to 75 pages / endpoints
- 3 user roles
- Full methodology + business logic testing
- 5-day turnaround
- PDF report + delivery call
- Compliance-ready certificate
- 3 free re-tests (90 days)

### Enterprise — $4,999
- Unlimited scope
- 5 user roles
- Custom test scenarios
- 7–10 day turnaround
- Dedicated Slack channel + delivery call
- Attestation letter
- Unlimited re-tests (6 months)

All plans are one-time engagements — no annual contracts required.

## Methodology

Our testing methodology covers:

- **Reconnaissance & Discovery**: Mapping application structure, identifying technologies, and discovering attack surface
- **Authentication & Session Management**: Testing login flows, session handling, password policies, and multi-factor authentication
- **Authorization & Access Control**: Verifying role-based access, privilege escalation, and IDOR vulnerabilities
- **Input Validation**: SQL injection, XSS, command injection, and other injection flaws
- **Business Logic**: Testing application-specific workflows for logic flaws and abuse scenarios
- **API Security**: REST/GraphQL endpoint testing, rate limiting, and data exposure
- **Configuration & Deployment**: Server hardening, TLS configuration, security headers, and error handling

## Frequently Asked Questions

### What exactly does the AI do vs. the human experts?
We use a combination of automated tools and AI-guided tests to greatly reduce the time-consuming, repetitive tasks that are common in traditional penetration testing. This lets us cover more ground, faster. Our experts then verify every result to ensure the findings are relevant, accurate, and genuinely helpful for your team.

### Is this just an automated scanner?
No. Automated scanners find surface-level issues and produce many false positives. Our approach combines automated tooling with AI-guided testing and expert human verification. The AI handles the repetitive work, freeing our experts to focus on deeper analysis — business logic, authentication flows, and the nuanced vulnerabilities that scanners miss.

### What do I need to provide to get started?
The URL of your application, the scope (which areas to test), and any test credentials if you want authenticated testing. We'll send you a brief questionnaire that takes about 5 minutes to complete.

### Will testing affect my production environment?
We currently only test non-production environments (staging or development). Our automated systems may click buttons or submit forms that could modify data, so running against production is not recommended. In terms of load, a web application penetration test simulates roughly 10 concurrent users — if your app can handle that, it can handle our testing. If testing a non-production environment is not possible, we recommend the Enterprise tier for expert-guided testing with more careful, hands-on control.

### What does the report include?
An executive summary, detailed findings with severity ratings (CVSS), step-by-step reproduction instructions, screenshots/evidence, and specific remediation guidance for each vulnerability. Your developers will know exactly what to fix and how.

### What happens after I fix the vulnerabilities?
You can use your included free re-tests to have us verify the fixes. We'll confirm the vulnerabilities are resolved and provide an updated report. This is included at no extra cost with every plan.

### Do you sign NDAs?
Yes. We sign a mutual NDA and a formal authorization-to-test agreement before any engagement begins. We take confidentiality seriously — your data is handled securely and destroyed after the engagement.

## About Triton InfoSec

pentests.work is a brand of Triton InfoSec, a cybersecurity consultancy specializing in web application security. By leveraging AI automation, pentests.work delivers enterprise-grade penetration testing at competitive prices with faster turnaround times.

## Links

- Homepage: https://pentests.work
- Get Started: https://pentests.work/get-started
- Sample Report: https://pentests.work/sample-report
- About: https://pentests.work/about
- Privacy Policy: https://pentests.work/privacy
- Terms of Service: https://pentests.work/terms