Audit-grade penetration testing you can start in minutes.
Honest pricing. Real external attack surface pentesting. We test everything an attacker can reach: web apps, APIs, cloud endpoints and network services using real exploitation, not just scanners. Aligned to PCI-DSS, SOC 2, NYDFS Cybersecurity, HIPAA, and CMMC. Buy online in minutes. No sales calls, no quotes.
testing experience
major industry sectors
certifications held
Five commitments that separate a real pentest from a quick-find scan.
"Audit-grade" is a category, not a slogan. It means the report holds up to an auditor's scrutiny, an underwriter's review, and your prospect's security team. Not because we say so, but because of what we commit to do on every engagement.
Retest from scratch
When you remediate, we retest everything from scratch, not just the listed findings. New issues that surfaced since the original test get reported too. The report is accurate as of the date issued, not just for the findings of record.
Full in-scope coverage
If you list it, we test it. Every service on every in-scope asset, including proprietary protocols. We don't sample, we don't skip, we don't stop early because we had good findings in an early round of testing.
Multi-protocol depth
VPNs, firewalls, DNS, mail, APIs, proprietary protocols. We test what's actually exposed, not just what scanners recognize as a web server.
Honest pricing
Published list pricing by the number of assets you want tested. No quote, no negotiation, no sales-rep discount theater. If we're running behind on capacity, we tell you before you pay, not after.
Self-serve, no calls
Answer a few quick questions, purchase, and a few days later you receive your report. No scoping call, no sales rep, no procurement-cycle drag. We are happy to go over the report on a video call afterwards, but our goal is to deliver the results you need quickly.
Bug-bounty and PtaaS testing chases quick wins.
Audits don't grade you on quick wins, they grade you on coverage.
Crowd-sourced bug-bounty platforms, Pentest-as-a-Service marketplaces, and AI-driven scanners all optimize for time-to-first-finding. They are excellent at surfacing the obvious. They are not designed to comprehensively test what's exposed across your scope. Auditors and insurance underwriters know the difference. So do we.
Quick-find testing
Bug-bounty and PtaaS researchers race for the first finding. Coverage of the rest of your scope isn't the goal of the system, and it isn't what gets reported.
Scanner-only testing
Automated tools find what they recognize. Anything beyond a web server: VPNs, firewalls, DNS, mail, APIs, proprietary protocols is mostly missed or lightly tested at best..
Audit-grade testing
Every service on every in-scope asset, including non-standard ports and non-web protocols. If you list it, we test it. The report is accurate as of the date issued, not just for the findings of record from a previous report.
Fixed scope. Published rates. No surprises.
Priced by the number of assets you want tested — hosts, IPs, or cloud endpoints — so you only pay for your actual environment. Manual validation is included on every engagement and we don't report false positives.
| Hosts, IPs, or cloud endpoints to test | Price | Price per asset |
|---|---|---|
| 1 | $4,995 | $4,995 |
| 2–4 | $7,995 | $1,999 – $3,997 |
| 5–8 | $10,995 | $1,374 – $2,199 |
| 9–16 | $15,995 | $1,000 – $1,777 |
| 17–32 Most Popular | $25,995 | $812 – $1,529 |
| 33–64 | $36,995 | $578 – $1,121 |
| 65–128 | $52,995 | $414 – $815 |
| 129–256 | $72,995 | $285 – $566 |
Manual validation included on every engagement. No false-positive reports. Fixed pricing designed for fast procurement. The time your team saves not managing a sales process has real value and will get you to a remediated state faster.
From purchase to report in five steps.
Every step is designed to be fast and low-friction. Most customers are in active testing within five business days of purchase.
Choose your scope
Select the IP range that matches your environment from our published pricing tiers. No scope negotiation, no custom quotes. Just pick what fits.
Complete your purchase
Self-serve checkout via Stripe. No PO required for standard tiers. Payment confirms your engagement immediately.
Confirm scope and schedule
We'll reach out within one business day to confirm your target systems, rules of engagement, emergency contacts, and testing window.
Testing occurs
Active testing during the agreed window. Your designated emergency contact remains reachable throughout. We pause immediately if anything unexpected arises.
Receive your report
Professional deliverables: executive summary, technical findings, risk ratings, remediation guidance, and compliance attestation delivered within five business days of test completion. We can also schedule a video call to review the report and answer any questions you have. We are also happy to do seperate technical and board-ready video calls if needed.
No surprises. Every engagement includes all of this.
We don't tier our deliverables. Every customer at every scope level receives the same professional reporting package.
Executive Summary
A non-technical narrative written for leadership, boards, and auditors. Summarizes risk posture, key findings, and recommended priorities.
IncludedTechnical Findings Report
Every identified vulnerability documented with evidence, affected systems, attack path, and technical context. Written for your security and engineering teams.
IncludedRisk Ratings
Each finding rated Critical, High, Medium, or Low with CVSS scores where applicable. Clear, consistent risk language your auditors recognize.
IncludedRemediation Guidance
Step-by-step remediation recommendations for every finding, prioritized by risk level and tailored to your specific environment.
IncludedCompliance Attestation Letter
A signed attestation letter which includes scope and testing coverage. Formatted for submission to auditors reviewing PCI-DSS, SOC 2, NYDFS, HIPAA, or CMMC requirements.
IncludedExpert Recommendations
Practitioner-level guidance drawn from direct observation of your environment and prioritized next steps written by the tester who found the issues, not a templated checklist.
IncludedSee the deliverable format before committing.
Download a full sample report. No email required, no pressure, no follow-up calls. We believe you should know exactly what you're buying before you buy it.
Common questions, answered directly.
Do I need a sales call to get started?
What compliance frameworks does your testing support?
How long does testing take?
Can I see a sample report before I buy?
What if my environment includes cloud infrastructure (AWS, Azure, GCP)?
Who actually performs the testing?
How does scheduling work after I purchase?
What systems can I include in scope?
What is your refund policy?
Do you offer retesting after remediation?
Built and operated by a senior practitioner.
Pentest Express is built around a disciplined, practitioner-first mindset: deliver a strong quality baseline, keep scope and pricing clear, and avoid adding complexity customers didn't ask for.
Trey Blalock is a highly respected senior penetration tester who has performed extensive work across almost every major security domain for some of the world's largest corporations and governments. His background combines hands-on technical depth, large-scale security operations, and extensive speaking and training experience across advanced security topics.
Over fifteen years of experience providing penetration testing and assessment services to hundreds of clients in the financial, government, retail, chemical, aviation, oil & gas, medical, educational, legal, telecom, and law enforcement sectors.
He has trained numerous Fortune 100 companies, consulting firms, and federal agencies including the DIA, FBI, and NSA on network security, system security, attack and penetration testing, and cloud security. He has performed thousands of penetration tests for Fortune 500 companies globally across various infrastructure devices, operating systems, protocols, and applications.
Trey speaks frequently about advanced security topics at financial institutions and Fintech conferences in the US, Europe, and Africa. He has spoken at DefCon and MITRE ATT&CKcon, and delivered two keynotes at the Department of Homeland Security's annual CISA conferences. He currently serves on several forensic, red-team, and penetration-testing advisory boards, and is a frequent television and podcast guest.
Professional certifications.
Active certifications held across penetration testing, cloud security, forensics, risk management, and compliance.
Ready to get started, or have a question?
Start your test now through our self-serve checkout, or email us directly if you have questions before committing. We respond fast.