{
  "catalog_version": "1.0",
  "updated": "2026-09-23",
  "url": "https://www.pentestexpress.com/catalog.json",
  "provider": {
    "name": "Pentest Express",
    "legal_name": "Verification Labs, LLC",
    "url": "https://www.pentestexpress.com/",
    "email": "hello@pentestexpress.com",
    "founder": "Trey Blalock"
  },
  "service_type": "External penetration testing",
  "pricing": {
    "currency": "USD",
    "model": "Published fixed price by asset count. No quote process.",
    "unit": "host, IP, or cloud endpoint",
    "unit_note": "Count each public-facing host, IP, or cloud endpoint you want tested. They do not have to be contiguous or in the same network.",
    "hidden_fees": false,
    "price_is_final": true,
    "brackets": [
      {
        "assets_min": 1,
        "assets_max": 1,
        "label": "1",
        "price": 4995
      },
      {
        "assets_min": 2,
        "assets_max": 4,
        "label": "2–4",
        "price": 7995
      },
      {
        "assets_min": 5,
        "assets_max": 8,
        "label": "5–8",
        "price": 10995
      },
      {
        "assets_min": 9,
        "assets_max": 16,
        "label": "9–16",
        "price": 15995
      },
      {
        "assets_min": 17,
        "assets_max": 32,
        "label": "17–32",
        "price": 25995
      },
      {
        "assets_min": 33,
        "assets_max": 64,
        "label": "33–64",
        "price": 36995
      },
      {
        "assets_min": 65,
        "assets_max": 128,
        "label": "65–128",
        "price": 52995
      },
      {
        "assets_min": 129,
        "assets_max": 256,
        "label": "129–256",
        "price": 72995
      }
    ],
    "above_maximum": {
      "assets_min": 257,
      "action": "contact",
      "contact": "hello@pentestexpress.com",
      "note": "Genuinely large environments need a scoping conversation."
    }
  },
  "included": [
    "Manual penetration testing",
    "Executive summary",
    "Technical findings",
    "Compliance attestation letter",
    "Free retest within 14 days of report delivery"
  ],
  "retest": {
    "free_within_days": 14,
    "reduced_rate_window_days": [
      15,
      60
    ],
    "reduced_rate_percent_of_original": 25,
    "after_days": 60,
    "after_note": "A full re-engagement is recommended; environments have typically drifted.",
    "scope": "Everything is retested from scratch, not only the listed findings."
  },
  "turnaround": {
    "published": "typical_only",
    "day_type": "business",
    "fastest": {
      "business_days": 3,
      "conditions": "Single IP or host, standard scope"
    },
    "clock_starts": {
      "card_payment": "At checkout.",
      "sow_payment": "When the DocuSign signature is completed."
    },
    "varies_with": [
      "asset count",
      "complexity of the external attack surface"
    ],
    "guaranteed": false,
    "note": "Three business days is achievable for a single-asset engagement, counted from checkout or from completed DocuSign signature on a SOW. Duration scales with the size and complexity of the external attack surface, and a specific timeline can be confirmed if needed.",
    "expedite_available": true,
    "expedite_note": "An ASAP option is available in the order form for tight audit deadlines."
  },
  "exclusions": [
    "Credentialed review of cloud console, IAM, or directory configuration is a separate engagement not currently offered.",
    "Internal network testing is not part of an external engagement; see the network testing page."
  ],
  "critical_findings": "The designated emergency contact is notified immediately and testing is paused if appropriate. Critical findings are not held back until the final report.",
  "purchase": {
    "sales_call_required": false,
    "method": "web order form",
    "url": "https://form.typeform.com/to/TIEYojPa",
    "payment_processor": "Stripe",
    "alternative": {
      "method": "Statement of Work",
      "note": "Select the SOW option at signup; it is sent for signature through DocuSign instead of running payment through Stripe."
    },
    "note": "Per-bracket direct purchase URLs are not yet published."
  },
  "services": [
    {
      "id": "soc2",
      "name": "SOC 2 Penetration Testing: $4,995, Audit-Ready",
      "category": "compliance",
      "url": "https://www.pentestexpress.com/soc2.html",
      "description": "SOC 2 penetration testing with published pricing from $4,995. Audit-grade manual testing, signed attestation letter, free 14-day retest. No sales calls."
    },
    {
      "id": "pci-dss",
      "name": "PCI-DSS Penetration Testing for Requirement 11.4 (External)",
      "category": "compliance",
      "url": "https://www.pentestexpress.com/pci-dss.html",
      "description": "External penetration testing built for PCI-DSS Requirement 11.4. Get the external half of your annual pentest started fast, with audit-grade reporting your QSA will accept. Honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "hipaa",
      "name": "HIPAA Penetration Testing for Covered Entities & Business Associates",
      "category": "compliance",
      "url": "https://www.pentestexpress.com/hipaa.html",
      "description": "External penetration testing that strengthens your HIPAA Security Rule risk analysis and evaluation. Audit-grade evidence for OCR readiness and BAA security reviews. Honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "iso-27001",
      "name": "ISO 27001 Penetration Testing for Annex A 8.8 & 8.29 Evidence",
      "category": "compliance",
      "url": "https://www.pentestexpress.com/iso-27001.html",
      "description": "External penetration testing that produces accepted evidence for ISO/IEC 27001 Annex A 8.8 and 8.29. Audit-grade reporting for your certification or surveillance audit. Honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "cmmc",
      "name": "Penetration Testing to Support CMMC Assessment Readiness",
      "category": "compliance",
      "url": "https://www.pentestexpress.com/cmmc.html",
      "description": "External penetration testing that supports CMMC assessment readiness for DoD and DIB contractors. Audit-grade evidence for your CA and RA practices. Honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "nydfs",
      "name": "NYDFS Part 500 Penetration Testing for Covered Entities",
      "category": "compliance",
      "url": "https://www.pentestexpress.com/nydfs.html",
      "description": "External penetration testing built for NYDFS 23 NYCRR Part 500. Section 500.05 annual pentest evidence your examiner and CISO will accept. Honest published pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "ffiec",
      "name": "FFIEC Penetration Testing for Bank & Credit Union IT Exams",
      "category": "compliance",
      "url": "https://www.pentestexpress.com/ffiec.html",
      "description": "Penetration testing built for FFIEC IT examination requirements. Audit-grade findings and an attestation letter your examiner can review. Honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "gdpr",
      "name": "GDPR Article 32 Penetration Testing",
      "category": "compliance",
      "url": "https://www.pentestexpress.com/gdpr.html",
      "description": "Penetration testing built for GDPR Article 32 security-of-processing requirements. Audit-grade findings and an attestation letter. Honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "glba",
      "name": "GLBA Safeguards Rule Penetration Testing",
      "category": "compliance",
      "url": "https://www.pentestexpress.com/glba.html",
      "description": "Penetration testing built for the GLBA Safeguards Rule's testing and monitoring requirement. Audit-grade findings and an attestation letter. Honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "external",
      "name": "External Network Penetration Testing",
      "category": "target",
      "url": "https://www.pentestexpress.com/external.html",
      "description": "External network penetration testing of your internet-facing perimeter. Manual exploitation, audit-grade reporting, honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "network",
      "name": "Network Penetration Testing (Internal & External)",
      "category": "target",
      "url": "https://www.pentestexpress.com/network.html",
      "description": "Internal and external network penetration testing. Manual exploitation of hosts, services, and infrastructure. Audit-grade reporting, honest pricing from $4,995."
    },
    {
      "id": "website",
      "name": "Website & Web Application Penetration Testing",
      "category": "target",
      "url": "https://www.pentestexpress.com/website.html",
      "description": "Manual penetration testing of your website or web application: authentication, business logic, and injection flaws. Audit-grade reporting, honest pricing from $4,995."
    },
    {
      "id": "api",
      "name": "API Penetration Testing (REST & GraphQL)",
      "category": "target",
      "url": "https://www.pentestexpress.com/api.html",
      "description": "Manual penetration testing of REST and GraphQL APIs: authentication, authorization, and business-logic flaws. Audit-grade reporting, honest pricing from $4,995."
    },
    {
      "id": "cloud",
      "name": "Cloud Penetration Testing (AWS, Azure, GCP)",
      "category": "target",
      "url": "https://www.pentestexpress.com/cloud.html",
      "description": "External penetration testing for cloud infrastructure across AWS, Azure, and GCP. Manual testing of exposed services, storage, and leaked credentials. Honest pricing from $4,995."
    },
    {
      "id": "aws",
      "name": "AWS Penetration Testing",
      "category": "target",
      "url": "https://www.pentestexpress.com/aws.html",
      "description": "External penetration testing for AWS environments: exposed storage, internet-facing workloads, and leaked credentials. Audit-grade reporting. Honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "azure",
      "name": "Azure Penetration Testing",
      "category": "target",
      "url": "https://www.pentestexpress.com/azure.html",
      "description": "External penetration testing for Azure environments: exposed storage, internet-facing workloads, and leaked credentials. Audit-grade reporting. Honest pricing from $4,995. Self-serve, no sales calls."
    },
    {
      "id": "gcp",
      "name": "GCP Penetration Testing",
      "category": "target",
      "url": "https://www.pentestexpress.com/gcp.html",
      "description": "External penetration testing for Google Cloud environments: exposed storage, internet-facing workloads, and leaked credentials. Audit-grade reporting. Honest pricing from $4,995. Self-serve, no sales calls."
    }
  ],
  "documents": {
    "sample_report": "https://form.typeform.com/to/pBbFlfLG",
    "sample_attestation_letter": "https://form.typeform.com/to/pBbFlfLG",
    "pricing": "https://www.pentestexpress.com/pricing.html",
    "terms_of_service": "https://www.pentestexpress.com/terms.html",
    "security_contact": "https://www.pentestexpress.com/.well-known/security.txt",
    "sitemap": "https://www.pentestexpress.com/sitemap.xml",
    "llms": "https://www.pentestexpress.com/llms.txt"
  },
  "contact": {
    "email": "hello@pentestexpress.com"
  }
}