Start here
FLAGSHIP_SERVICE // Q2_2026
PENETRATION TEST
Fixed-price web and API penetration testing: a complete VAPT, vulnerability assessment and penetration testing, of your application.
A real engineer plus 75 AI-powered scanners try to break into your application, then you get a PDF report your CEO can read, your auditor will accept, and your engineers can actually fix. The same engine powers our PhantomDragon AI scanner; if you're searching VAPT in Sri Lanka, start there.
Want proof before a call? See a sample report, the exact format your team receives.
$2,499
Fixed price · no hidden fees
5-7 days
From kickoff to delivery
75
Attack categories tested
FREE
Re-test after you patch
DELIVERABLES
What you actually get
Most pentest firms hand you a 60-page Word doc and disappear. We give you six artifacts a real team can use.
Executive PDF report
Plain-English findings written for a CEO, not just a CTO. Includes risk score, severity breakdown, AI-generated executive summary.
Developer JSON + SARIF
Machine-readable findings for SonarQube, GitHub Advanced Security, your CI pipeline.
Reproducible proof
Each high-severity finding includes a step-by-step PoC your engineers can replicate.
Free re-test
Once you patch, we re-run the scan and issue an updated clean report, no extra charge.
30-day Q&A
Email your assigned engineer with follow-up questions for 30 days after delivery.
Attestation letter
Signed PDF letter you can hand to auditors, customers, or VCs as proof of testing.
SAMPLE REPORT
See an anonymized 8-page sample of what your team will receive. Real findings, real format, real attestation block.
IDEAL FOR
Who buys this
B2B SaaS preparing for SOC 2 / ISO 27001 audit
Startups in VC due-diligence (Series A / B / C)
Healthtech & telehealth (HIPAA prep)
Fintech / lending / payments (PCI-DSS lighter pass)
E-commerce platforms hitting $1M+ ARR
Companies that just had a security questionnaire come back from an enterprise prospect
SCOPE
What web and API penetration testing covers
The engagement is full web application penetration testing plus API security testing, your public app, your REST or GraphQL endpoints, authentication, and the business logic behind them. The web app is tested against the OWASP Top 10; the API surface is tested against the OWASP API Security Top 10, where broken object-level authorization and broken authentication live. Everything in scope by default:
Web application (your public-facing app)
REST or GraphQL API
Up to 3 subdomains
Authentication / session management
Business-logic abuse (price tampering, IDOR, auth bypass)
OWASP Top 10 + 65 other attack categories
TLS / DNS / certificate config
Stripe / payment webhook handling (if applicable)
OUT OF SCOPE (by default)
Mobile apps, internal corporate networks, social engineering / phishing, denial-of-service testing, and third-party SaaS we don't control (Stripe, Auth0, etc.). Each is available as an add-on, talk to us about pricing.
COMPLIANCE
Compliance evidence your auditor accepts
The signed attestation letter and executive PDF satisfy the technical-testing requirement for PCI DSS 11.4, SOC 2, and ISO 27001, and the test follows OWASP and NIST 800-115 methodology, so the report is built to clear an audit, not just inform your engineers. Each finding maps to OWASP, PCI DSS, SOC 2, ISO 27001, and NIST, the same compliance crosswalk the AI engine produces.
This is compliance penetration testing without the policy-and-evidence overhead: the Pentest tier covers the independent-testing control in each framework. Full compliance prep, writing policies, gathering control evidence, is a separate Custom engagement.
On PCI DSS, stated plainly: this engagement covers the external application-layer slice of requirement 11.4 only, meaning 11.4.3 external penetration testing plus the 11.4.4 loop of re-testing until exploitable findings are corrected. Internal penetration testing and segmentation testing are not covered; if your assessor requires those, you will need a second provider for the internal work.
SOC 2 penetration testing
SOC 2 never explicitly requires a pentest, but auditors expect one as monitoring evidence, commonly mapped to CC4.1. What that means for Type I vs Type II timing.
Read the guideISO 27001 penetration testing
ISO 27001:2022 control A.8.8 lists penetration testing among vulnerability-identification methods, and A.8.29 covers security testing in development. How one report maps to both.
Read the guideTIMELINE
From cal link to clean report
Typical engagement runs 5-7 calendar days. Expedited 72-hour delivery available for $1,000.
Day 0
Booking
15-minute call. We confirm scope, sign the engagement letter, you send target details.
Day 1-3
Scanning
PhantomDragon AI runs the full 75-scanner sweep with manual oversight. Average runtime: 3-6 hours.
Day 3-5
Analysis
Lead engineer reviews each finding, eliminates false positives, links multi-step attack chains.
Day 5-7
Delivery
PDF + JSON + SARIF + attestation. 30-min walkthrough call to explain every HIGH finding.
Day 7-30
Re-test
Once you patch, we re-scan free and issue an updated report. Q&A inbox stays open for 30 days.
Need it in 72 hours?
Add expedited delivery. Same full VAPT, kicked off immediately.
COST
What VAPT costs, and why fixed price
The penetration testing cost here is a flat $2,499, the whole engagement, not an hourly estimate. An equivalent web-and-API engagement from a traditional firm typically runs $5,000 to $35,000 once scoping, hours, and change orders are added. PTaaS platforms price the same work as a subscription or a credit pool (Astra publishes Pentest Basic at $1,999/yr and Pentest Plus at $5,999/yr per target); ours is a one-time fixed price, and the report is yours with no renewal attached. We quote one number and hold it. Expedited 72-hour delivery is $1,000 extra; the ongoing security retainer is $2,999/mo. Full pricing lives on the pricing page.
QUESTIONS
Common questions
Why is this so much cheaper than the big firms?
+
We're a small senior team based in Sri Lanka, engineering costs ~1/5 of US bay-area rates. We pass that on. The work is the same caliber; the overhead isn't.
How much does a penetration test cost in 2026?
+
This engagement is a flat $2,499 for web and API penetration testing, free re-test included. For context, 2026 cost guides from DeepStrike, Blaze Infosec, Intruder, and Astra put typical web-app pentests at roughly $5,000 to $35,000+, and Intruder cites day rates of $1,000 to $3,000. Full market breakdown in our cost guide.
How long does a penetration test take?
+
Published guides put a typical market engagement at 4 to 6 weeks end to end, from scoping to the final report. Ours delivers the executive PDF in 5 to 7 days: 75 scanners parallelize the coverage work, so the engineer's days go to business logic and chained attacks instead of enumeration.
Will the report be accepted by my auditor or enterprise customer?
+
Yes: every report follows OWASP / NIST methodology, includes scope statement, severity-ranked findings, executive summary, remediation guidance, and a signed-and-dated attestation. We can share sample anonymized reports under NDA before you commit.
What about HIPAA / SOC 2 / PCI-DSS specific requirements?
+
The Pentest tier covers the technical-testing requirement in all three frameworks. For full compliance prep (policies, controls, evidence gathering), we have a Custom / Enterprise engagement, talk to us.
Do you test production or a staging environment?
+
Either works. Staging is safer; production is more accurate. We run in non-destructive mode regardless, no data modification, no real exploits against live customer records.
What if you find a critical issue mid-scan?
+
We pause immediately, message your point of contact within an hour, and confirm before continuing. Critical findings never sit waiting for the final report.
Can we expedite delivery?
+
Yes: 72-hour delivery is available for $1,000 extra. Most engagements don't need it; SOC 2 auditors are fine with 5-7 days.
What's NOT included?
+
Mobile apps (iOS/Android), internal corporate networks, social engineering / phishing employees, denial-of-service testing, and third-party services we don't control (Stripe, Auth0, etc.). Most of these are available as add-ons.
Written and delivered by Ryan Sebastian, founder
Ghost Protocol was founded in Colombo in 2024. Ryan scopes the engagement, runs the attack chains alongside the scanner fleet, writes the report, and signs the attestation letter, so the person answering your 30-day Q&A is the person who did the work. More about Ryan.
Stop losing enterprise deals over a missing pentest report.
One $2,499 engagement. Fixed price. Five to seven days. A real report you can hand to an auditor on Monday.
ENCRYPTED_INTAKE // GLOBAL_DELIVERY // PO_READY