---
title: "Which PharosOne product do I need? Five situations, five prices"
canonical: https://pharosone.ai/knowledge/which-product-do-i-need
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-22
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"Which PharosOne product do I need? Five situations, five prices\". PharosOne, 2026-10-22. https://pharosone.ai/knowledge/which-product-do-i-need"
---

# Which PharosOne product do I need? Five situations, five prices

> Audit deadline, new agent, agent in production, weekly releases or a free trial: the PharosOne product, price, time and deliverable for each.

URL: https://pharosone.ai/knowledge/which-product-do-i-need · Category: Guides · Published: 2026-10-22 · Updated: 2026-10-22 · Author: PharosOne Research · Reviewed by: PharosOne editorial

*PharosOne sells every product on this page and wrote this article.*

**In short.** An auditor's or a customer's request for a pentest means the human pentest, from €9,500. A new agent means the €3,900 AI agent security assessment first, with the agent pentest from €15,000 when breaches must be closed with a retest letter. Agents already in production call for Pharos Radar from €1,500 per month and, when features ship every sprint, continuous testing from €3,000 per month; the free Pharos Framework is the way to try before buying.

## Key facts

- Updated: 22 October 2026
- For: anyone choosing a first PharosOne product
- Price: free (Pharos Framework); €3,900 (AI agent security assessment); from €9,500 (human pentest); from €15,000 (AI agent pentest); from €1,500 per month (Pharos Radar); from €3,000 per month (continuous testing); all net of VAT, monthly prices billed yearly
- Time: 5 working days for the assessment; report in week 3 for a pentest; Radar and continuous testing run for the subscription year
- You receive: see the table below
- Standards: SOC 2 CC4.1, PCI DSS 11.4, ISO 27001 A.8 and DORA Art. 24–25 for the human pentest; AIUC-1, ISO 42001, EU AI Act Art. 9 and 15 and the OWASP Agentic Top 10 for the agent products
- Next step: book a 30-minute scoping call at audit@pharosone.ai

## Which situation are you in?

| Situation | Product | Price | Time | What you receive |
|---|---|---|---|---|
| An auditor or a customer asks for a pentest | Human pentest | from €9,500 (web, API, cloud, code); from €12,000 (internal network); from €15,000 (AI agents) | SOW in 3 days; report in week 3; retest within 90 days | executive summary; findings with CVSS and reproducible evidence; attack chain; retest letter; mapping to SOC 2 CC4.1, PCI DSS 11.4, ISO 27001 A.8, DORA Art. 24–25 |
| We are about to ship an agent | AI agent security assessment | €3,900 fixed | 5 working days | attack success rate; top findings with transcripts; AIUC-1 and OWASP Agentic mapping; credit to a human pentest ordered within 90 days of the report |
| We already run agents in production | Pharos Radar | from €1,500 per month, billed yearly | runs continuously | a yes-or-no verdict per turn; findings with evidence span, severity, AIUC-1 control, OWASP LLM Top 10 cross-reference |
| We ship agent features every sprint | Continuous testing | from €3,000 per month, billed yearly | before every release; every quarter | pre-release findings; quarterly retest report as AIUC-1 evidence |
| We want to try before buying | Pharos Framework | free, Apache 2.0 | a run on your machine or in CI | attack success rate with a Wilson interval per probe; AIUC-1 coverage; blind spots listed |

All prices are net of VAT; each "from" price is the smallest standard scope, and the exact number is fixed in the SOW after a 30-minute scoping call ([PharosOne pricing](https://pharosone.ai/pricing), October 2026).

## What is the ladder?

The products form a ladder, and each rung carries something to the next. In PharosOne's review of 100 AI security vendors (October 2026, PharosOne not in the sample), 2 offer offensive testing of AI systems, a human red team, a classic pentest and compliance evidence, each at least in partial form ([What 100 AI security vendors sell](/knowledge/ai-security-market-2026)). The ladder puts those four in one place.

1. **Pharos Framework, free.** Run it yourself. Its report tells you which attack classes your agent fails and which probes it could not run.
2. **AI agent security assessment, €3,900.** Autonomous: PharosOne's own AI agents run the whole test, adaptively; an engineer reviews the findings and signs the report. Credited in full to a human pentest ordered within 90 days of the report.
3. **AI agent pentest, from €15,000.** Engineer-led: senior engineers direct the same AI agents, validate every result, re-test it by hand and chain what the agents find, on one agent or LLM application with everything it touches. A full report with a retest letter. After the credit, €11,100.
4. **Pharos Radar, from €1,500 per month.** Production monitoring of the conversations and tool calls your integration sends, in the same cabinet as the pentest findings.
5. **Continuous testing, from €3,000 per month.** Agent changes tested before release, at the volume fixed in the SOW, and a retest every quarter, as AIUC-1 evidence.

Steps 2 and 3 both use AI agents; the difference is how much a person operates, validates and re-checks. Nobody has to climb every rung.

## An auditor or a customer asks for a pentest.

Order the human pentest and say on the scoping call who will read the report and by when. The engineer scopes the test to the clause the reviewer cites:

- SOC 2 CC4.1 asks for "ongoing and/or separate evaluations" and names penetration testing in its points of focus ([AICPA TSC](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022));
- PCI DSS 11.4 asks for internal and external penetration testing at least once every 12 months and after significant changes, with exploitable findings corrected and retested ([PCI SSC, v4.0.1](https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf));
- DORA Articles 24 and 25 ask for a testing programme with penetration testing among its tests and tests at least yearly on systems supporting critical or important functions ([EUR-Lex](https://eur-lex.europa.eu/eli/reg/2022/2554/oj));
- ISO 27001:2022 Annex A.8 asks for management of technical vulnerabilities (A.8.8) and security testing in development and acceptance (A.8.29) ([ISO](https://www.iso.org/standard/27001)).

Every engagement includes an AI exposure check of the agents reachable from the scope, an inventory and a first attempt on each, so the reviewer's second question, "and the AI?", gets a first answer in the same report. Plan backwards from the date the reviewer needs the documents: the retest and the closure letter sit inside the 90-day window after the report. Details: [human pentest](/knowledge/human-pentest) and the [preparation guide](/knowledge/preparing-for-a-soc2-or-dora-pentest-with-ai-agents).

## We are about to ship an agent.

Start with the AI agent security assessment. In 5 working days you know the attack success rate against your exact agent and which of its tools an attacker can drive, with an engineer reviewing the findings and signing the report. If the result is clean, you have a dated third-party test of that version; the release decision stays yours. If it is not, the €3,900 becomes a credit against the full agent pentest, which adds senior engineers who direct the agents and re-check every result by hand, the CVSS findings and the retest letter. Details: [AI agent security assessment](/knowledge/ai-agent-security-assessment).

## We already run agents in production.

Add Pharos Radar. A pentest describes the agent on the day of the test; Radar reads the conversations and tool calls your integration sends afterwards and flags a turn where the agent was manipulated or acted outside its role, and where data left. It returns a yes-or-no verdict. With per-turn integration the verdict returns in the same call, so a flagged reply is held and a flagged tool call does not run. With the one-line wrapper the verdict arrives as the call returns and applies from the next turn. It is not a proxy between your application and the model provider: with the wrapper nothing waits on it, and with per-turn integration your application waits for the verdict before it acts, so it must handle a timeout. Every flag is filed as a finding with its evidence span and its AIUC-1 control. Details: [Pharos Radar](/knowledge/pharos-radar).

## We ship agent features every sprint.

Add continuous testing. New tools, MCP servers, inputs and memory are tested before they ship, at the volume fixed in the SOW, and the whole agent is retested every quarter with a dated report mapped to AIUC-1, whose certification includes quarterly retests and annual re-certification ([aiuc-1.com](https://www.aiuc-1.com/)). The full pentest sets the first measurement; continuous testing keeps it current. Details: [continuous testing](/knowledge/continuous-testing).

## We want to try before buying.

Run the Pharos Framework. It is free under Apache 2.0, runs offline with no API key in its mock tier and against a real agent with model access, and reports an attack success rate with a Wilson confidence interval per probe mapped to AIUC-1 controls ([pharosone/pharosone](https://github.com/pharosone/pharosone)). It runs on your machine with an attacker model you configure, and no person reviews its findings; the first two paid rungs add PharosOne's own attacking agents and an engineer who signs the report. Details: [Pharos Framework](/knowledge/pharos-framework).

## FAQ

### What is the cheapest way to start?

The Pharos Framework is free and runs on your machine. The first paid step is the €3,900 AI agent security assessment, credited in full to a human pentest ordered within 90 days of the report.

### Do I need both a pentest and Radar?

They answer different questions. A pentest shows what the agent did under attack before release; Radar reads what it does in production. An agent that moves money or customer data has a reason for both, and the same team runs them in one cabinet.

### Can I move from the assessment to the full pentest?

Yes. Order a human pentest within 90 days of the date on the assessment report and the €3,900 is deducted from its price.

### Are prices fixed?

Yes. The listed prices are net of VAT, and each "from" price is the smallest standard scope of that product; the exact number is fixed in the SOW after a 30-minute scoping call and does not move during the engagement.

### My auditor needs the report by a date. Where do I start?

Count back from the date your reviewer needs the documents: SOW within 3 days of the scoping call, testing in weeks 1–2, report in week 3, then the time your team needs to fix findings before the retest, which runs within 90 days of the report. Ask your auditor whether they need the closure letter or only the report.

## Sources

1. [PharosOne pricing](https://pharosone.ai/pricing). PharosOne, 2026-10-22.
2. [2017 Trust Services Criteria (With Revised Points of Focus – 2022), criterion CC4.1](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022). AICPA, 2022.
3. [PCI DSS v4.0.1, Requirement 11.4](https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf). PCI Security Standards Council, 2024-06.
4. [Regulation (EU) 2022/2554 (DORA), Articles 24 and 25](https://eur-lex.europa.eu/eli/reg/2022/2554/oj). Official Journal of the European Union, EUR-Lex, 2022-12-27.
5. [ISO/IEC 27001:2022, Annex A.8 Technological controls](https://www.iso.org/standard/27001). ISO, 2022-10.
6. [AIUC-1, certification process (quarterly retests, annual validity)](https://www.aiuc-1.com/). Artificial Intelligence Underwriting Company, 2026.
7. [pharosone/pharosone, PharosOne Security Scanner](https://github.com/pharosone/pharosone). GitHub, 2026.
8. [What 100 AI security vendors sell in 2026](https://pharosone.ai/knowledge/ai-security-market-2026). PharosOne Research, 2026-10-22.

Source: PharosOne, "Which PharosOne product do I need? Five situations, five prices", https://pharosone.ai/knowledge/which-product-do-i-need, updated 2026-10-22.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt