---
title: "Pentest for companies running AI agents: scopes, days and prices"
canonical: https://pharosone.ai/knowledge/human-pentest
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-23
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"Pentest for companies running AI agents: scopes, days and prices\". PharosOne, 2026-10-23. https://pharosone.ai/knowledge/human-pentest"
---

# Pentest for companies running AI agents: scopes, days and prices

> From €9,500 for a web app and its API over 7 senior days to €15,000 for an AI agent with its tools. Report in week 3; retest and status letter included.

URL: https://pharosone.ai/knowledge/human-pentest · Category: Products · Published: 2026-10-22 · Updated: 2026-10-23 · Author: PharosOne Research · Reviewed by: PharosOne editorial

*PharosOne sells penetration testing and wrote this article.*

**In short.** A PharosOne human pentest is a fixed-scope penetration test run by senior engineers against a web application and its API, a cloud environment, a code base, an internal network or an AI agent. €9,500 buys a human pentest of a web application with an AI exposure check (an inventory and a first attempt on each agent); a full AI agent pentest starts at €15,000. It is bought by companies whose auditor or customer asks for a pentest report, and by those meeting PCI DSS 11.4 or a risk-based DORA testing programme. Prices are net of VAT, the report lands in week 3, and one retest within 90 days with a closure letter is included.

## Key facts

- Updated: 23 October 2026
- For: companies whose auditor, regulator or customer asks for a pentest report, and that run AI agents or LLM features on the tested stack
- Price: from €9,500 net of VAT for web, API, cloud or source code; from €12,000 for an internal network; from €15,000 for AI agents and LLM applications; the exact number is fixed in the SOW after a 30-minute scoping call
- Time: SOW within 3 days of the scoping call, testing in weeks 1–2, report in week 3, retest within 90 days
- You receive: in week 3, the report with an executive summary, findings with CVSS scores and reproducible evidence, and the attack chain; after your fixes, one retest and a retest letter with the status of each finding
- Standards: SOC 2 CC4.1, PCI DSS 11.4, ISO 27001 Annex A.8, DORA Art. 24–25; agent scopes add AIUC-1, ISO 42001, EU AI Act Art. 9 and 15, OWASP Agentic Top 10
- Next step: book a 30-minute scoping call at audit@pharosone.ai

## What is a human pentest?

A penetration test (pentest) is a time-boxed, authorised attack on a defined scope in which security engineers try to gain access, escalate privileges, move data or change records the way a real attacker would, and document every step so the owner can reproduce the result and fix it. A human pentest at PharosOne means that a senior engineer plans the attack and runs it, and the same engineer writes the report. The engineers direct PharosOne's own AI agents as their tools: they orchestrate the agents, validate every result, re-test it by hand and chain what the agents find. The judgement about what is exploitable and what it means for the business stays with a person. In the [AI-run pentest](/knowledge/ai-agent-security-assessment) the same agents run the whole test, and an engineer reviews the findings and signs the report.

The scope is fixed before testing starts. The €9,500 price covers the reference web scope: one application plus its API, up to 3 user roles and about 75 endpoints, tested over 7 senior days. Larger or more complex applications take more days, and most web projects land between €12,000 and €18,000 ([PharosOne pricing](https://pharosone.ai/pricing), October 2026). Larger scopes are priced in the SOW before day one, never by the day after the fact.

## Who needs one?

Four frameworks come up on the scoping call, and each asks in its own words. PCI DSS requires penetration testing; DORA lists it among the tests of a risk-based testing programme; SOC 2 and ISO 27001 name it as one way to meet a broader control, and many auditors and customers expect one.

- **SOC 2.** Criterion CC4.1 requires that "the entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning", and its points of focus name penetration testing as one such evaluation ([AICPA, 2017 TSC with revised points of focus, 2022](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)).
- **PCI DSS.** Requirement 11.4 of v4.0.1 reads "External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected", with tests at least once every 12 months and after significant changes, and correction and retest of what is found ([PCI SSC, June 2024](https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf)).
- **DORA.** Article 24 of Regulation (EU) 2022/2554 requires a testing programme with tests at least yearly on all ICT systems supporting critical or important functions, and Article 25 lists penetration testing among those tests ([EUR-Lex](https://eur-lex.europa.eu/eli/reg/2022/2554/oj); DORA applies from 17 January 2025).
- **ISO 27001.** Annex A.8 of ISO/IEC 27001:2022 includes A.8.8 management of technical vulnerabilities and A.8.29 security testing in development and acceptance ([ISO, 2022](https://www.iso.org/standard/27001)).

A customer's security questionnaire asks the same question in plainer words, and the same report answers it.

## What is tested, and what does it cost?

| Scope | What is in it | Senior days | From |
|---|---|---|---|
| Web application and API | one application plus its API, up to 3 roles, about 75 endpoints | 7+ | €9,500 |
| Cloud environment | the cloud environment that hosts the application | 7+ | €9,500 |
| Source code | the code behind the scope, with findings confirmed on the running system | 7+ | €9,500 |
| Internal network | up to about 200 hosts and one Active Directory domain | 8–9 | €12,000 |
| AI agents and LLM applications | one agent or LLM application with everything it touches: its tools, MCP servers, memory and knowledge base; several agents or a multi-agent system priced on the scoping call | 10 | €15,000 |
| WAF, antivirus and EDR bypass | whether the controls in front of the application or on the endpoint stop a real payload | 5–6 operator days | €9,500 |
| Red team | one objective, about 25 operator days over 6–8 weeks | ~25 operator days | €38,000; indicative budget for 3–4 objectives: €55,000–80,000 |

Prices are net of VAT; each "from" price is the scope described in its row, and the exact number is fixed in the SOW after a 30-minute scoping call ([PharosOne pricing](https://pharosone.ai/pricing), October 2026). A second retest round, after the included one, costs 15% of the project price.

**The AI exposure check.** Every engagement, whatever the scope, includes an AI exposure check: the engineers inventory the AI agents and LLM features reachable from the tested scope, including MCP servers, together with the untrusted inputs each one reads and the tools it can call, and then try to drive each one through those inputs within the agreed days. The check is an inventory and a first attempt on each agent; it does not replace the AI agents scope. A web pentest that ignores the support bot reading your tickets misses an entry point an attacker can use.

## Are the agents on the stack in scope?

Yes, at two depths. The AI exposure check covers agents as part of any scope. When the agent is the product, or when it holds tools that move money or data, book the AI agents and LLM applications scope: 10 senior days on one agent or LLM application with everything it touches (its tools, MCP servers, memory and knowledge base), with several agents or a multi-agent system priced on the scoping call. Senior engineers direct PharosOne's AI agents, and every bypass is reproduced and confirmed by a person before it enters the report.

The threat model follows the OWASP Top 10 for Agentic Applications: ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse and ASI06 Memory and Context Poisoning are the classes most often reachable through an agent's inputs ([OWASP GenAI Security Project, 9 December 2025](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/)). Findings from this scope are mapped to AIUC-1 controls such as B002 "Detect adversarial input" and B006 "Prevent unauthorized AI agent actions" ([AIUC-1 standard](https://standard.aiuc-1.com/)), and to ISO 42001, EU AI Act Articles 9 and 15 and the OWASP Agentic Top 10. Article 15(5) of the Act requires high-risk systems to be "resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities" ([artificialintelligenceact.eu](https://artificialintelligenceact.eu/article/15/)); the agent scope produces test evidence for that requirement. The Act's high-risk duties apply to standalone Annex III systems from 2 December 2027 ([European Commission timeline](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act)), and whether an agent is high-risk depends on its use under Annex III.

## What does the report contain?

The report is written for two readers: the engineer who fixes and the reviewer who signs.

- **Executive summary.** Background, the posture verdict, the conclusion and a "what is working" section, readable in three minutes. A posture statement that lists only weaknesses is half a statement.
- **Findings.** Each finding carries a CVSS score and vector, the affected assets, a description, the evidence needed to reproduce it (the exact requests and payloads, with screenshots where they help), the risk, the business impact and the remediation. A section with nothing to report says "None observed." instead of disappearing.
- **Attack chain.** The path from the first foothold to the final impact, so the reader sees which single fix breaks the chain.
- **Retest letter.** After remediation the engineers re-run every finding and issue a closure letter stating what was fixed and what remains. Reviewers who ask for proof of remediation usually ask for this document.

## What is the process?

| Step | When | What happens |
|---|---|---|
| Scoping call | Day 0 | 30 minutes; the engineer who will test asks about the stack, the agents on it, the reviewer and the deadline |
| SOW | Day 1–3 | fixed scope, fixed price, test window, rules of engagement |
| Testing | Week 1–2 | senior engineers test the agreed scope |
| Report | Week 3 | executive summary, findings, attack chain, standards mapping |
| Retest | Within 90 days | every finding re-checked; closure letter issued |

## Who runs it?

Senior engineers only, and the engineer who scoped the project is the one who tests it, so the scope agreed on the call goes into testing without a handover. The team's public record (PharosOne team, October 2026):

- 22 published CVEs
- Black Hat speaker
- DEF CON 28 IoT CTF winner
- OSEP certification
- author of PCF (Pentest Collaboration Framework) and IoTSecFuzz
- 15+ years in cyber security

References available under NDA.

## FAQ

### Is a retest included in the price?

Yes. One retest within 90 days of the report is included and ends with a closure letter. A second retest round costs 15% of the project price.

### Will a SOC 2, PCI DSS or DORA reviewer accept the report?

Acceptance is the reviewer's decision, and no tester can promise it. The report is written for that reader: scope, dates and methodology are stated, findings carry CVSS scores and reproducible evidence, and the closure letter documents remediation. Agree the scope and the standard with your auditor before testing starts; DORA threat-led penetration testing (TLPT) is a separate regime that this pentest does not replace.

### How long does a pentest take from first call to report?

The SOW is signed within 3 days of a 30-minute scoping call, testing runs in weeks 1 and 2, and the report arrives in week 3.

### What is the difference between the human pentest and the €3,900 AI agent security assessment?

Both use PharosOne's AI agents. The assessment is autonomous: our agents run the whole test against one AI agent, and an engineer reviews the findings and signs the report, in 5 working days. The human pentest is engineer-led: senior engineers direct the agents, validate every result and re-test it by hand over 7 or more days, with a full report and a retest. The €3,900 is credited in full to a human pentest ordered within 90 days of the report.

### Are the prices fixed?

Yes. The price is fixed in the SOW after the scoping call and does not move during the engagement. Prices are net of VAT; each starting price buys the reference scope listed in the table, and larger scopes are priced in the SOW.

### Are the AI agents on my stack part of a normal web or network pentest?

Yes, at inventory depth. Every engagement includes an AI exposure check of the agents and LLM features reachable from the tested scope, within the agreed days. It does not replace a test of the agent itself: when the agent is the product, book the AI agents and LLM applications scope, from €15,000.

## Sources

1. [2017 Trust Services Criteria (With Revised Points of Focus – 2022), criterion CC4.1](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022). AICPA, 2022.
2. [PCI DSS v4.0.1, Requirement 11.4](https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf). PCI Security Standards Council, 2024-06.
3. [Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Articles 24 and 25](https://eur-lex.europa.eu/eli/reg/2022/2554/oj). Official Journal of the European Union, EUR-Lex, 2022-12-27.
4. [ISO/IEC 27001:2022, Annex A.8 Technological controls](https://www.iso.org/standard/27001). ISO, 2022-10.
5. [OWASP Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/). OWASP GenAI Security Project, 2025-12-09.
6. [AIUC-1 standard, control list (domain B, Security)](https://standard.aiuc-1.com/). Artificial Intelligence Underwriting Company, 2026.
7. [EU AI Act, Article 15, Accuracy, Robustness and Cybersecurity](https://artificialintelligenceact.eu/article/15/). artificialintelligenceact.eu, 2024.
8. [AI Act implementation timeline, after the AI Omnibus](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act). European Commission, AI Act Service Desk, 2026.
9. [PharosOne pricing](https://pharosone.ai/pricing). PharosOne, 2026-10-22.

Source: PharosOne, "Pentest for companies running AI agents: scopes, days and prices", https://pharosone.ai/knowledge/human-pentest, updated 2026-10-23.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt