Penetration testing at a fixed price
One web application and its API, up to three hostnames and two user roles, tested by hand after our scanning engine has swept it. $4,000, report in 5 to 7 days, re-test included.
A report your board can read, and a signed letter for your auditor
Six things, all inside the fixed price. None of them is sold separately.
Executive report
Every finding rated and explained in plain English, with the decisions to make first. Page one is a summary anyone can read; the finding pages are written for your engineers.
Signed attestation letter
One to two pages stating who tested what, when, by which method, and the outcome. It is the document you give auditors, customers and investors.
Reproduction steps
Every high-severity finding comes with step-by-step proof your engineers can replay in staging.
Developer findings in JSON and SARIF
The same findings in machine-readable form, for GitHub Advanced Security, SonarQube or your CI pipeline.
A free re-test
Once you have fixed the findings, we test them again and reissue the report and the letter.
30 days of questions
Email the engineer who ran your test with follow-up questions for 30 days after delivery.
GP-EXAMPLE-2026-001 · page 4 of 15
We were able to create an administrator account on the Northwind Retail application from the public internet, without a password, without an invitation, and without touching any staff system. That single weakness gives an attacker the whole customer database. It is fixed now.
- 1 Critical
- 2 High
- 2 Medium
- 1 Low
- 1 Info
Report in 5 to 7 days, re-test up to day 30
The testing is one week. The three weeks after it are yours, to fix and have the fixes checked. Working against an audit date? Delivery in 72 hours is $500 extra.
- Day 0
Booking
A 15-minute call. We confirm the scope and sign the engagement letter, and you send the target details.
- Day 1
Automated sweep
PhantomDragon, our scanning engine, runs its 75+ scanner modules across the scope while the engineer watches. It takes a few hours.
- Days 1 to 5
Manual testing
The engineer checks every finding by hand, removes false positives, and tests what scanners cannot see: business logic, and attacks that chain several steps.
- Days 5 to 7
Delivery
The report, the attestation letter, and the JSON and SARIF findings, with a 30-minute call to walk through every high-severity finding.
- Days 7 to 30
Re-test
Once you have fixed the findings, we test them again and reissue the report at no charge. Your questions stay open for 30 days.
Tested to NIST SP 800-115 and the OWASP standards
We follow published standards, so your auditor or your own team can check our work against them.
The process: NIST SP 800-115
- Planning
- Scope, written authorisation, rules of engagement, and who we call if something critical turns up.
- Discovery
- We map every host, page, parameter and user role, with an automated sweep and by hand.
- Attack
- We verify, exploit and chain what we find. Nothing reaches the report on scanner output alone.
- Reporting
- The report, the developer findings and the attestation letter.
The coverage: OWASP
- OWASP Top 10 (2021)
- The ten most common web application risks. All ten are tested.
- OWASP API Security Top 10 (2023)
- Your API, where the checks on who may read or change which record usually fail.
- OWASP Web Security Testing Guide (WSTG)
- The test list for each control: login, sessions, access, input handling, errors and the browser side.
- Business logic
- Tested by hand: price and quantity tampering, coupon and refund abuse, steps taken out of order, one role acting as another.
Where the report counts as evidence
The report and the signed letter are written to be filed with an audit. They support the controls below; they do not make you compliant on their own.
| Framework | Control | What the test gives you |
|---|---|---|
| ISO/IEC 27001:2022 | A.8.8 · A.8.29 | Documented evidence that technical vulnerabilities are found, evaluated and acted on, with re-test proof that the fixes worked. ISO 27001 penetration testing |
| SOC 2 | CC4.1 | No criterion names a penetration test. Auditors file one here, as evidence that your controls are evaluated. SOC 2 penetration testing |
| PCI DSS | 11.4.3 · 11.4.4 | The external application-layer test, and the loop of fixing and re-testing. Internal and segmentation testing are not covered. |
| CBSL Technology Risk Management and Resilience | Banking Act Directions No. 16 of 2021 | Evidence toward the testing these Directions ask of licensed banks. One part of that duty, not the whole of it, and not compliance on its own. |
| Sri Lanka Personal Data Protection Act (PDPA) | Act No. 9 of 2022 | Evidence toward the duty to protect personal data with measures suited to the risk. The Act does not require a penetration test, and a test does not make you compliant. |
Not sure which of these reach your company? The security obligations checker maps four answers to the Sri Lankan instruments that apply, each cited.
What is tested, and what is not
In scope
- Your public web application
- Its REST or GraphQL API
- Up to three hostnames, tested grey-box with logins for two user roles
- Login, sessions and password reset
- Business-logic abuse: price tampering, one customer reading another's records, a user acting above their role
- The OWASP Top 10 and 65 further attack categories
- TLS, DNS and certificate configuration
- Payment webhook handling, such as Stripe, where you have it
Not included
- Mobile apps (iOS and Android)
- Internal corporate networks, including the internal and segmentation testing PCI DSS also asks for
- Social engineering and phishing of your staff
- Denial-of-service testing
- Third-party services you do not control, such as your payment processor or identity provider
- Physical security
A larger scope (more apps, hostnames or roles) is quoted per scope: see the regulated and enterprise row on the pricing page.
One price, quoted before we start and held
Invoiced by Ghost Protocol (Private) Limited, company number PV00305227. Pay by card when you book, or ask for an invoice. Companies registered in Sri Lanka have a local rate card.
- Penetration test: one web app and its API, up to three hostnames and two user roles
- $4,000
- The report, the signed attestation letter, JSON and SARIF findings, the re-test, 30 days of questions
- Included
- Optional: delivery in 72 hours
- +$500
Questions buyers ask before booking
Ryan Sebastian, our founder, leads every engagement: he scopes it, runs the manual testing, writes the report and signs the attestation letter. The person answering your questions is the person who did the work. More about Ryan
Why is this so much cheaper than the big firms?
Four reasons, all structural. About four engineer-days go into each engagement, billed at a Colombo rate rather than a US one. PhantomDragon, our own scanning engine with 75+ scanner modules, does the coverage work, so those days go to exploitation and chaining instead of enumeration. The scope is fixed (one web app and its API), so there is no scoping overhead. And there is no platform fee and no sales team between you and the engineer. The method is NIST SP 800-115 and OWASP, the report is built for auditors, and the engineer who led the test signs the attestation letter; only the overhead is lower.
Some 2026 guides say anything under $3,000 is a scan in disguise. Is this one?
Those lines are drawn by firms selling tests above $5,000, and the platforms themselves now sell $1,999 to $3,500 AI-only products under the word pentest. Ours is $4,000, so it sits above that line, but the price is not what makes it a pentest. An engineer runs the manual phase, every high-severity finding ships with reproduction steps, a free re-test follows your fixes, and the engineer who led the test signs the attestation letter. The sample report shows all four.
How much does a penetration test cost in 2026?
This engagement is a flat $4,000 for web and API penetration testing, re-test included. For context, 2026 cost guides from DeepStrike, Blaze Infosec, Intruder and Astra put typical web application tests at roughly $5,000 to $35,000 or more, AI-only tests from Cobalt and Intruder list from $3,500, and Intruder cites day rates of $1,000 to $3,000. The full market breakdown is in our cost guide.
How long does a penetration test take?
Published guides put a typical engagement at 4 to 6 weeks end to end, from scoping to the final report. Ours delivers the report in 5 to 7 days: our scanning engine's 75+ scanner modules run the coverage work in a few hours on day 1, so the engineer's days go to business logic and chained attacks instead of enumeration.
Will my auditor or enterprise customer accept the report?
It is written for them: a scope statement, the method (NIST SP 800-115 and OWASP), findings ranked by severity, an executive summary, remediation guidance, and a signed, dated attestation letter. Acceptance is your auditor's decision, so read our example report first; we also share an anonymised real report under NDA before you commit.
What about SOC 2, ISO 27001 and PCI DSS?
For SOC 2 and ISO 27001 the test is the evidence auditors look for (CC4.1, and A.8.8 with A.8.29). For PCI DSS it covers the external application-layer part of requirement 11.4 only: 11.4.3 and the 11.4.4 re-test. Internal and segmentation testing are not included. Writing policies and gathering control evidence is a separate regulated or enterprise engagement.
Do you test production or a staging environment?
Either. Staging is safer; production is more accurate. We test non-destructively either way: no data is changed outside the test accounts we create, and no exploit is run against live customer records.
What if you find a critical issue during the test?
We pause, tell your named contact within an hour, and confirm with you before continuing. A critical finding never waits for the final report.
Can we expedite delivery?
Yes. Delivery in 72 hours is $500 extra. Most engagements do not need it; SOC 2 auditors are generally fine with 5 to 7 days.
Do Sri Lankan companies pay in LKR?
Yes. Companies registered in Sri Lanka are invoiced in LKR at a local rate card, a separate price for the local market rather than a conversion. The figures are on the penetration testing in Sri Lanka page.
Talk to an engineer before you book
Email ryan@ghosts.lk or message +94 71 055 5055 on WhatsApp. Ryan replies within 24 hours, Monday to Friday, 09:00 to 18:00 Colombo time (UTC+5:30).
Book a 15-minute call Start the intake Buying for a company? Procurement details