Your SOC 2 auditor or enterprise prospect asked for a pentest report. Here's how to get one without paying enterprise prices or waiting three months for a scoping call.
A penetration test is a controlled attack on your systems, designed to find what a real attacker would find before they do. Kobalt's pentest team is OSCP and GWAPT-certified, combines automated scanning tools with hands-on expert analysis on every engagement, and delivers reports your auditor will accept on the first pass.
A penetration test is a controlled security assessment in which Kobalt's team attempts to exploit vulnerabilities in your application, network, or infrastructure, the same way a real attacker would. Unlike a pure vulnerability scan, which flags known CVEs automatically, a penetration test layers automated discovery with expert analysis: testers chain findings together and demonstrate actual impact.
Every Kobalt engagement starts with automated reconnaissance and scanning, then adds in-depth expert analysis to validate, chain, and exploit what the tools surface. You get a detailed report covering every finding, its severity, step-by-step reproduction steps, and specific remediation instructions. Critical findings are reported immediately. You do not wait until the final report.
Automated tools surface the full attack surface fast. Expert testers then chain and exploit findings to demonstrate real impact, not just flag CVEs.
Critical vulnerabilities are reported the same day they're found. You don't wait for the final report to start remediating.
Reports formatted to satisfy SOC 2 auditors, ISO 27001 certification bodies, and enterprise security questionnaires. Hundreds delivered. They pass.
A lot of companies overpay for tests they do not need, or underpay for tests that miss the critical attack surface. Kobalt's team helps you scope correctly before you sign anything.
| Black Box | Grey Box Recommended | White Box | |
|---|---|---|---|
| Access given to tester | None (simulates external attacker with no prior knowledge) | Credentials and API documentation | Full access including source code |
| Best for | Minimum compliance requirement | Most web applications and APIs | Applications storing sensitive, financial, or health data |
| What it finds | External surface vulnerabilities | Authenticated vulnerabilities, privilege escalation, broken authorization | Deep code-level flaws, architecture weaknesses, logic vulnerabilities |
| Kobalt's take | Minimum viable | Recommended for most clients | High-risk applications |
| Pricing | |||
| Small | $3,000 | $3,000 to $4,250 | Custom Typically $25,000+ Scoped on call |
| Medium | $5,750 | $5,750 | |
| Large | — | $7,500 | |
| Plus | Custom | Custom | |
Kobalt recommends Grey Box for most web applications. It provides the best balance of cost and security depth, testing how far an attacker can get once they have basic access, which reflects the most common real-world breach scenario.
Internal and external network penetration testing. Covers firewalls, segmentation, open ports, service enumeration, and lateral movement paths. Scoped by IP range or subnet.
iOS and Android application testing mapped to OWASP Mobile Top 10. Covers insecure data storage, improper authentication, reverse engineering exposure, and API vulnerabilities.
Purpose-built for applications built on large language models. Tests for prompt injection, sensitive data disclosure, insecure output handling, and jailbreaking. Mapped to OWASP Top 10 for LLM Applications.
We agree on test type, scope, and timeline. You receive a fixed quote. No variable billing.
Automated scanning and expert analysis run in parallel. Critical findings reported same day, not held for the final report.
Every finding: CVSS score, description, step-by-step reproduction, specific remediation guidance.
We walk through findings with your team. Developers leave knowing exactly what to fix and why.
Within 3 months: retest remediated findings at 20% of original cost.
Most security frameworks mandate annual penetration testing. If you are working toward any of the following, a pentest is already on your checklist:
| Framework | What it requires |
|---|---|
| SOC 2 | Required for most SOC 2 Type II programs, particularly Security and Availability Trust Service Criteria. Enterprise buyers expect a test dated within 12 months. |
| ISO 27001 | Annex A control A.8.8 requires vulnerability management including testing. Most certification bodies expect annual penetration tests. |
| HIPAA | The Security Rule's technical safeguard provisions require regular technical evaluation of the security environment, including penetration testing. |
| PCI-DSS | Requirement 11.4 mandates penetration testing at least annually and after any significant infrastructure or application change. |
| Enterprise security reviews | Most Fortune 500 and mid-market questionnaires ask for a pentest report dated within 12 months. Not having one disqualifies you. |
If you are already running a Kobalt compliance program, a penetration test is the one piece that is always sold as a separate engagement. Most clients complete their first test during the SOC 2 readiness phase and repeat it annually.
Most companies remediate findings and move on. A retest closes the loop: a tester returns to the same vulnerabilities and verifies the fix holds under real attack conditions, not just a regression check.
The retest covers only the findings from the original engagement. If your application has changed significantly since the original test, a re-scoped engagement is the right call. Ask during your debrief and we will advise.
They have given you a deadline. You need a test that produces a report your auditor will accept without follow-up questions.
Your team believes it is secure. You have never verified it from the outside. A penetration test tells you what a real attacker would find before they do.
The report had generic recommendations and no reproduction steps. Kobalt's reports are specific to your application and written for the team that has to act on the findings.
SOC 2 and ISO 27001 require annual tests. You have completed your first one. You need the next one on schedule. Kobalt offers preferential renewal pricing.
New to pentesting, or preparing for your first engagement? These guides answer the questions we hear most from startups and growing companies.
Most web application tests complete within 1–2 weeks from the start of the testing window. From scoping call to final report, most small to medium engagements run 2–3 weeks total. Rush engagements can be accommodated; raise it during the scoping call.
Black Box and Grey Box are priced by scope size. Small: $3,000. Medium: $5,750. Grey Box Large: $7,500. Plus (larger or more complex scope): custom quote. White Box, network, mobile, and AI/LLM tests are scoped individually. All pricing is fixed. No variable billing.
Black box simulates an external attacker with no prior knowledge. Grey box provides credentials and documentation, simulating a credentialed user attempting to escalate privileges. Grey box finds more vulnerabilities and better reflects real-world breaches. Kobalt recommends grey box for most web application engagements.
Every report includes an executive summary, CVSS severity scores, step-by-step reproduction instructions, specific remediation guidance, and a prioritized remediation matrix. Critical findings are reported immediately during testing, not held until the final report.
Most SOC 2 Type II programs require a penetration test, particularly for the Security and Availability Trust Service Criteria. Auditors typically request a report dated within the prior 12 months. Kobalt's reports are formatted to satisfy SOC 2 audit requirements.
Yes. Within 3 months of the original test, Kobalt provides a retest at 20% of the original cost. The retest validates that specific vulnerabilities were remediated correctly. It does not re-cover the full application scope.
An AI/LLM penetration test assesses applications built on large language models for prompt injection, sensitive information disclosure, insecure output handling, and jailbreaking. Mapped to the OWASP Top 10 for LLM Applications. Available standalone or as an add-on to a web application test.
SOC 2 and ISO 27001 both expect annual penetration tests. Your previous report is valid for the period it covers, but auditors and enterprise buyers will ask for a current one, typically within 12 months. Kobalt offers preferential pricing for annual renewals.
Most compliance standards recommend annual testing. Businesses that deploy frequent updates or handle sensitive data should test more frequently, particularly after major releases or significant infrastructure changes. Annual is the baseline. If your application changes substantially between tests, re-scoping is the right call.
A vulnerability scan is an automated process that flags known CVEs. Penetration testing starts there and goes further: automated tools map the full attack surface, then expert testers chain and exploit findings to demonstrate actual impact and real-world attack paths. Vulnerability scans are a component of a pentest, not a substitute for one. Automated tools alone miss logic flaws, broken authorization, and multi-step attack chains. Expert analysis is what turns a list of flags into a demonstrated attack path.
No. Testing is designed to be non-disruptive. Scope and testing windows are agreed in the scoping call before anything begins. If a tester encounters something unexpected that could affect stability, they will notify you immediately before proceeding. Kobalt does not perform destructive testing unless explicitly agreed in scope.
You receive a detailed report covering every finding with CVSS severity scores, step-by-step reproduction instructions, and specific remediation guidance. Your team joins a debrief call to walk through findings and ask questions. Critical findings are already remediation-ready because they were flagged during the test window, not at the end. Once your team has addressed the findings, you can book a retest at 20% of the original cost to verify the fixes hold.