Penetration Test for Your SaaS: $99, AI-Verified
A $99 pen test is an authorized, AI-verified external security assessment of your web application and API surface, delivered as a severity-rated PDF report, typically in 2–3 hours.
No subscription. One flat price. AI-verified results.
What does a $99 penetration test cover?
The $99 penetration test is a focused external assessment of your web app and API surface. It covers the OWASP Top 10 (injection, XSS, authentication flaws, access control, misconfiguration), session and login handling, API endpoint enumeration and object-level authorization, plus TLS configuration and security headers.
Web application
OWASP Top 10: injection, XSS, auth flaws, access control, misconfig.
Authentication
Session handling, OTP/login flows, token and cookie hardening.
API surface
Endpoint enumeration, broken object-level authorization, input validation.
Transport & headers
TLS config, security headers, exposed metadata and tech fingerprinting.
What is included in the pen test, and what is not?
Included: automated scanning with httpx, nuclei and OWASP ZAP baseline, AI-assisted triage, AI verification of every reported issue, severity-rated findings with remediation guidance, and a downloadable PDF report. Not included: DDoS or load testing, social engineering, physical testing, malware or destructive testing, source-code review, infrastructure or cloud pentesting, and mobile apps.
Fixed scope, stated plainly. You confirm it before anything is tested.
What's included
- Automated scanning (httpx, nuclei, OWASP ZAP baseline)
- AI-assisted triage of findings
- AI verification of every reported issue
- Severity-rated findings with remediation guidance
- Downloadable PDF security report
What's not included
- DDoS or load/stress testing
- Social engineering or phishing
- Physical security testing
- Malware or destructive testing
- Source-code review & infra/cloud pentest
- Mobile apps (MVP)
How long does a pen test take? Report in 2–3 hours
Your report is typically ready in 2–3 hours. After payment we validate your scope and target, run the security test suite, and an AI QA agent reviews every finding before the report reaches you. You can track each stage live, and the finished report is a downloadable PDF.
- 1Payment received
- 2Scope & target validated
- 3Security testing
- 4AI QA review
- 5Report delivered
How does the $99 pen test work?
Getting a pen test takes five steps: verify your email, enter your target, confirm you are authorized to test it, pay $99, and receive your report. Email verification, scope confirmation and authorization take about a minute. After payment, testing and AI verification run, and the report arrives typically in 2–3 hours.
- 1
Verify your email
Enter your email and confirm it with a one-time code.
- 2
Enter your target
Tell us the web application or API you want tested.
- 3
Confirm authorization
Confirm the scope and that you are authorized to test the target. Nothing is tested without this.
- 4
Pay $99
Pay the flat $99 price. There is no subscription.
- 5
Receive your report
We run the tests, AI agents verify every finding, and you download your severity-rated PDF report, typically in 2–3 hours.
How much does a pen test cost?
A pen test with PenTest99 costs $99, one flat price per test. There is no subscription. The price covers automated scanning, AI-assisted triage, AI verification of every reported issue, severity-rated findings with remediation guidance, and a downloadable PDF security report, delivered typically in 2–3 hours.
$99
- One flat price: $99
- No subscription
- Report typically in 2–3 hours
- Authorization required before anything is tested
Who is a $99 pen test for?
The $99 pen test is for SaaS teams that run a web application or API and are authorized to test it. It is a focused external assessment with a fixed, stated scope, so it suits teams who want a clear, severity-rated report without a subscription. Targets are tested only with your explicit authorization.
What your report looks like
Clear findings, each with severity, impact, and remediation.
- HighMissing access control on /api/accounts/{id}api.example.com
- MediumSession cookie missing Secure + SameSiteapp.example.com
- LowVerbose server version header disclosedexample.com
Frequently asked questions about the $99 pen test
What is a $99 pen test?
It is an authorized, AI-verified external security assessment of your web application and API surface. We run real security tooling, AI agents verify every finding, and you receive a severity-rated PDF report, typically in 2–3 hours, for one flat $99.
What does the $99 penetration test cover?
It covers your web application (OWASP Top 10: injection, XSS, auth flaws, access control, misconfiguration), authentication (session handling, OTP/login flows, token and cookie hardening), your API surface (endpoint enumeration, broken object-level authorization, input validation), and transport and headers (TLS config, security headers, exposed metadata and tech fingerprinting).
How long does it take to get the report?
The report is typically delivered in 2–3 hours after payment. We validate your scope and target, run the test suite, and an AI QA agent reviews every finding before the report reaches you. You can track each stage live.
What is not included?
DDoS or load/stress testing, social engineering or phishing, physical security testing, malware or destructive testing, source-code review and infrastructure or cloud pentesting, and mobile apps (MVP) are not included.
Do I need authorization to test my target?
Yes. You confirm the scope and that you are authorized before anything is tested, and targets are tested only with your explicit authorization.
Is there a subscription?
No. It is one flat price of $99 with no subscription.
How are the findings verified?
AI agents verify every reported issue, and an AI QA agent reviews every finding before the report reaches you. Findings come from automated scanning (httpx, nuclei, OWASP ZAP baseline) followed by AI-assisted triage.
Is this a human-led manual penetration test?
No. PenTest99 uses automated tooling and AI-agent verification; it is not a human-led manual assessment.
What do I get at the end?
A downloadable PDF security report with severity-rated findings, each with impact and remediation guidance.
How do I get started?
Verify your email, enter your target, confirm you are authorized to test it, and pay $99. Email verification, scope confirmation and authorization take about a minute.
Ready? Test your app for $99.
Email verification, scope confirmation, and authorization take about a minute.
Start Pen Test — $99