Pricing
One flat price per pentest. Retest included.
No day rates, no scoping calls to get a number. Every test includes a certified pentester's review, the signed deliverables and a retest of what you fixed.
Per pentest
$5,000 USD, web app or API
Retest within 90 days included
Auditor-accepted, or your money back.
Get a pentest- A web application One web application and the APIs its pages call.
- Or an API A REST or GraphQL API on its own, tested from its documentation and traffic.
Partners
Partner pricing on request
For vCISOs, compliance consultancies and audit-readiness firms offering Ambit pentests to their clients.
Included in every test
Everything, at one price.
- AI-driven testing of the OWASP Top 10, the API Top 10 and all 114 WSTG test cases, as each of your test users
- OSCP/OSWE/OSEE-certified testers leading the engagement
- Findings reviewed, and the report signed, by a certified pentester
- Penetration test report with CVSS scores, evidence, steps to reproduce and remediation
- Attestation letter for auditors and customers
- Executive and customer summaries
- One retest of every fixed finding within 90 days, with a retest report
- Live progress, coverage and chat with the agent while it tests
- Signed documents anyone can verify by reference
- Auditor-accepted, or your money back.
FAQ
Pricing questions.
What does the money-back guarantee cover?
If your auditor won't accept the report as penetration test evidence, we refund the full price or retest at no charge, your choice. Send us their reason in writing. It covers the report, not the outcome of your audit.
What counts as one web application?
One application and the APIs its own pages call, tested from the addresses you give us. A separate product, or an API used by other clients that you want tested on its own, is a separate test. Tell us what you have and we'll tell you how it splits before testing starts.
What does the retest cover?
One retest of every finding you fixed, within 90 days of the report. You get a retest report that shows what is fixed, what is still open and what you accepted as risk, and the detailed report is reissued with the results.
How do we pay?
By invoice from Zonix Labs, Inc., the company behind Ambit, at the published price when you confirm the test. No card needed.
Is there anything extra to pay?
No. The price covers the testing, the pentester's review, every deliverable and the retest.
We have a larger scope, or several apps.
Book one test per application or API, or email us the scope and we'll quote it.
What kinds of testing aren't included?
Ambit tests web applications and APIs. Engagements for denial of service, social engineering, physical security and mobile apps are not part of an Ambit pentest.
Do you offer partner pricing?
Yes, for vCISOs, compliance consultancies and audit-readiness firms who offer pentests to their clients. Ask us for partner pricing.
Something else? Email us with your scope.
Get started
Your next pentest, in days.
Tell us what to test. A certified pentester leads the engagement, the agent does the legwork, and you get a signed report your auditor can use.
Fixed price. Results in days. Retest included.