Scope Your Assessment

Name (Required)

Title\Role (Required)

Company Name (Required)

This will be used on the report

0 of 50 max characters

Email (Required)

Company Email

Enter Email

Confirm Email

When would you like your test performed? (Required)

How did you hear about us? (Required)

What is the primary reason for this assessment? (Required)

e.g., compliance such as SOC 2, ISO 27001, PCI DSS, HIPAA, client requirement, or internal security initiative

0 of 100 max characters

Is onsite presence required during testing (e.g., for monitoring, access, or compliance purposes)? (Required)

Yes No

Address (Required)

What type of assessment are you looking to perform? (Required)

Please Note: Web Application Penetration Tests come with internal API endpoints. If internal API endpoint testing is needed as part of your Web Application Test, please select "Web Application Penetration Test" instead of a Web API Penetration Test.

Source Code Review

Are you looking to review more than one codebase or repository? (Required)

Source Code Review #1

Application / Project Name (Required)

Programming Language(s) Used (Required)

Please list all languages (e.g., Java, JavaScript, Python, PHP, Go, C#, etc.)

Frameworks or Libraries Used (Required)

Please specify key frameworks or libraries (e.g., React, Django, Spring Boot, Laravel, Node.js, .NET Core, etc.)

Approximate Lines of Code (LOC) (Required)

Do you want both static analysis and manual review? (Required)

Code Repository Type (Required)

How will source code be shared for review? (Required)

Git Access (recommended) ZIP Archive Upload Secure File Transfer (SFTP)

Branch(es) or Commit(s) to Review

Specify if review should target a specific branch, commit, or release version

Would you like dependency / package audit included (Required)

(e.g., npm audit, pip-audit, Snyk, etc.)?

Yes No

Do you want secrets scanning included? (Required)

(e.g., hardcoded keys, passwords, tokens)

Yes No

Do you want secure coding recommendations / best practice guidance as part of the report? (Required)

Yes No

Upload any supporting documentation (optional)

Architecture diagrams, development notes, or API specifications can reduce review time.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Source Code Review #2

Application / Project Name (Required)

Programming Language(s) Used (Required)

Please list all languages (e.g., Java, JavaScript, Python, PHP, Go, C#, etc.)

Frameworks or Libraries Used (Required)

Please specify key frameworks or libraries (e.g., React, Django, Spring Boot, Laravel, Node.js, .NET Core, etc.)

Approximate Lines of Code (LOC) (Required)

Do you want both static analysis and manual review? (Required)

Code Repository Type (Required)

How will source code be shared for review? (Required)

Git Access (recommended) ZIP Archive Upload Secure File Transfer (SFTP)

Branch(es) or Commit(s) to Review

Specify if review should target a specific branch, commit, or release version

Would you like dependency / package audit included (Required)

(e.g., npm audit, pip-audit, Snyk, etc.)?

Yes No

Do you want secrets scanning included? (Required)

(e.g., hardcoded keys, passwords, tokens)

Yes No

Do you want secure coding recommendations / best practice guidance as part of the report? (Required)

Yes No

Upload any supporting documentation (optional)

Architecture diagrams, development notes, or API specifications can reduce review time.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Source Code Review #3

Application / Project Name (Required)

Programming Language(s) Used (Required)

Please list all languages (e.g., Java, JavaScript, Python, PHP, Go, C#, etc.)

Frameworks or Libraries Used (Required)

Please specify key frameworks or libraries (e.g., React, Django, Spring Boot, Laravel, Node.js, .NET Core, etc.)

Approximate Lines of Code (LOC) (Required)

Do you want both static analysis and manual review? (Required)

Code Repository Type (Required)

How will source code be shared for review? (Required)

Git Access (recommended) ZIP Archive Upload Secure File Transfer (SFTP)

Branch(es) or Commit(s) to Review

Specify if review should target a specific branch, commit, or release version

Would you like dependency / package audit included (Required)

(e.g., npm audit, pip-audit, Snyk, etc.)?

Yes No

Do you want secrets scanning included? (Required)

(e.g., hardcoded keys, passwords, tokens)

Yes No

Do you want secure coding recommendations / best practice guidance as part of the report? (Required)

Yes No

Upload any supporting documentation (optional)

Architecture diagrams, development notes, or API specifications can reduce review time.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Source Code Review #4

Application / Project Name (Required)

Programming Language(s) Used (Required)

Please list all languages (e.g., Java, JavaScript, Python, PHP, Go, C#, etc.)

Frameworks or Libraries Used (Required)

Please specify key frameworks or libraries (e.g., React, Django, Spring Boot, Laravel, Node.js, .NET Core, etc.)

Approximate Lines of Code (LOC) (Required)

Do you want both static analysis and manual review? (Required)

Code Repository Type (Required)

How will source code be shared for review? (Required)

Git Access (recommended) ZIP Archive Upload Secure File Transfer (SFTP)

Branch(es) or Commit(s) to Review

Specify if review should target a specific branch, commit, or release version

Would you like dependency / package audit included (Required)

(e.g., npm audit, pip-audit, Snyk, etc.)?

Yes No

Do you want secrets scanning included? (Required)

(e.g., hardcoded keys, passwords, tokens)

Yes No

Do you want secure coding recommendations / best practice guidance as part of the report? (Required)

Yes No

Upload any supporting documentation (optional)

Architecture diagrams, development notes, or API specifications can reduce review time.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Source Code Review #5

Application / Project Name (Required)

Programming Language(s) Used (Required)

Please list all languages (e.g., Java, JavaScript, Python, PHP, Go, C#, etc.)

Frameworks or Libraries Used (Required)

Please specify key frameworks or libraries (e.g., React, Django, Spring Boot, Laravel, Node.js, .NET Core, etc.)

Approximate Lines of Code (LOC) (Required)

Do you want both static analysis and manual review? (Required)

Code Repository Type (Required)

How will source code be shared for review? (Required)

Git Access (recommended) ZIP Archive Upload Secure File Transfer (SFTP)

Branch(es) or Commit(s) to Review

Specify if review should target a specific branch, commit, or release version

Would you like dependency / package audit included (Required)

(e.g., npm audit, pip-audit, Snyk, etc.)?

Yes No

Do you want secrets scanning included? (Required)

(e.g., hardcoded keys, passwords, tokens)

Yes No

Do you want secure coding recommendations / best practice guidance as part of the report? (Required)

Yes No

Upload any supporting documentation (optional)

Architecture diagrams, development notes, or API specifications can reduce review time.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web Application Penetration Test

Are we assessing more than one web application for you? If yes, please specify how many. (Required)

Web Application #1

Web Application Name (Required)

Web Application URL (Required)

Web Application Purpose

Do you want testing done as an authenticated user of the system?(2 is recommended) (Required)

Yes No

If Yes, how many user accounts? (Required)

How many pages/screens does the application have in total that require testing? (Required)

How many internal endpoints does the application have in total that require testing? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web Application #2

Web Application Name (Required)

Web Application URL (Required)

Web Application Purpose

Do you want testing done as an authenticated user of the system?(2 is recommended) (Required)

Yes No

If Yes, how many user accounts? (Required)

How many pages/screens does the application have in total that require testing? (Required)

How many internal endpoints does the application have in total that require testing? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web Application #3

Web Application Name (Required)

Web Application URL (Required)

Web Application Purpose

Do you want testing done as an authenticated user of the system?(2 is recommended) (Required)

Yes No

If Yes, how many user accounts? (Required)

How many pages/screens does the application have in total that require testing? (Required)

How many internal endpoints does the application have in total that require testing? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web Application #4

Web Application Name (Required)

Web Application URL (Required)

Web Application Purpose

Do you want testing done as an authenticated user of the system?(2 is recommended) (Required)

Yes No

If Yes, how many user accounts? (Required)

How many pages/screens does the application have in total that require testing? (Required)

How many internal endpoints does the application have in total that require testing? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web Application #5

Web Application Name (Required)

Web Application URL (Required)

Web Application Purpose

Do you want testing done as an authenticated user of the system?(2 is recommended) (Required)

Yes No

If Yes, how many user accounts? (Required)

How many pages/screens does the application have in total that require testing? (Required)

How many internal endpoints does the application have in total that require testing? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web API Penetration Test

Are you looking to test more than one API? If yes, select how many. (Required)

Web API #1

Web API Name (Required)

Web API Purpose

Please specify the total API endpoints to be tested. (Required)

Do you want testing done as an authenticated user of the system (2 is recommended)? (Required)

Yes No

If yes, how many API Keys would you like tested? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web API #2

Web API Name (Required)

Web API Purpose

Please specify the total API endpoints to be tested. (Required)

Do you want testing done as an authenticated user of the system (2 is recommended)? (Required)

Yes No

If yes, how many API Keys would you like tested? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web API #3

Web API Name (Required)

Web API Purpose

Please specify the total API endpoints to be tested. (Required)

Do you want testing done as an authenticated user of the system (2 is recommended)? (Required)

Yes No

If yes, how many API Keys would you like tested? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web API #4

Web API Name (Required)

Web API Purpose

Web API Name (Required)

Please specify the total API endpoints to be tested. (Required)

Do you want testing done as an authenticated user of the system (2 is recommended)? (Required)

Yes No

If yes, how many API Keys would you like tested? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Web API #5

Web API Name (Required)

Web API Purpose

Please specify the total API endpoints to be tested. (Required)

Do you want testing done as an authenticated user of the system (2 is recommended)? (Required)

Yes No

If yes, how many API Keys would you like tested? (Required)

Do you have documentation of the API endpoints in a format such as OpenAPI, Swagger, or POSTMAN? (Required)

(This greatly reduces the hours necessary to complete the assessment)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Mobile Application Penetration Test

Are you looking to test more than one mobile application? If yes, select how many. (Required)

Mobile Application #1

Mobile Application Name (Required)

Mobile Application Purpose

Platform (Required)

iOS Android Both

How many API endpoints does the Mobile App have in total that require testing? (Required)

What counts as an endpoint? If you're using a REST API backend, you would count each path and method as an endpoint. If you are using GraphQL API backend, you would count each mutation or query as an endpoint.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Mobile Application #2

Mobile Application Name (Required)

Mobile Application Purpose

Platform (Required)

iOS Android Both

How many Public IP addresses need to be scanned? (Required)

What counts as an endpoint? If you're using a REST API backend, you would count each path and method as an endpoint. If you are using GraphQL API backend, you would count each mutation or query as an endpoint.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Mobile Application #3

Mobile Application Name (Required)

Mobile Application Purpose

Mobile Application Name (Required)

Platform (Required)

iOS Android Both

How many API endpoints does the Mobile App have in total that require testing? (Required)

What counts as an endpoint? If you're using a REST API backend, you would count each path and method as an endpoint. If you are using GraphQL API backend, you would count each mutation or query as an endpoint.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

External Network Vulnerability Scan

How many Public IP addresses need to be scanned? (Required)

Are all addresses available to the internet? (Required)

Yes No

If no, how will the IP addresses be accessed for assessment? (Required)

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

External Network Penetration Test

How many Public IP addresses need to be included in the penetration test? (Required)

Are all addresses available to the internet? (Required)

Yes No

If no, how will the IP addresses be accessed for assessment? (Required)

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Phishing Testing & Training

How many users?

How many campaigns do you want to run in a year?

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

PCI Scanning

How many IP addresses need to be scanned?

Are all addresses available to the internet? (Required)

Yes No

If no, how will the IP addresses be accessed for assessment? (Required)

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Cloud Penetration Test

Which cloud provider(s) are in scope? (Required)

AWS Azure GCP

What type of cloud assessment is required? (Required)

Configuration Review Penetration Test Both

How many cloud accounts/subscriptions/projects are in scope? (Required)

How many applications/services hosted in the cloud should be tested? (Required)

Should IAM (Identity and Access Management) be included? (Required)

Yes No

Do you require testing of cloud storage services (S3 buckets, Blob storage, etc.) (Required)

Yes No

If yes, please specify (Required)

Do you require testing of containerized services (e.g., Kubernetes, Docker Swarm, AWS ECS, OpenShift) (Required)

Yes No

If yes, please specify (Required)

Do you have documentation or diagrams of the cloud architecture? (Required)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Red Team Engagement

What is the primary objective of the red team exercise? (Required)

Data exfiltration Persistence Detection testing

Do you want the assessment to include physical intrusion attempts? (Required)

Yes No

Address (Required)

Should social engineering (e.g., phishing, vishing, onsite) be part of the engagement? (Required)

Yes No

Which defensive functions would you like us to engage during testing? (Required)

Security Operations Center (SOC) Blue Team (defensive security team) Incident Response Team

Duration of engagement (in weeks) (Required)

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Hardware Penetration Test

Are you looking to test more than one hardware device? If yes, specify how many. (Required)

Hardware Device #1

Device Name/Model: (Required)

Device Purpose/Use Case: (Required)

What interfaces should be tested? (e.g., USB, JTAG, UART, Wi-Fi, Bluetooth, NFC) (Required)

Do you want firmware analysis included? (Required)

Yes No

Will physical tampering/resilience testing be in scope? (Required)

Yes No

Do you have any available documentation or diagrams (e.g., schematics, manuals)? (Required)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Hardware Device #2

Device Name/Model: (Required)

Device Purpose/Use Case: (Required)

What interfaces should be tested? (e.g., USB, JTAG, UART, Wi-Fi, Bluetooth, NFC) (Required)

Do you want firmware analysis included? (Required)

Yes No

Will physical tampering/resilience testing be in scope? (Required)

Yes No

Do you have any available documentation or diagrams (e.g., schematics, manuals)? (Required)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Hardware Device #3

Device Name/Model: (Required)

Device Purpose/Use Case: (Required)

What interfaces should be tested? (e.g., USB, JTAG, UART, Wi-Fi, Bluetooth, NFC) (Required)

Do you want firmware analysis included? (Required)

Yes No

Will physical tampering/resilience testing be in scope? (Required)

Yes No

Do you have any available documentation or diagrams (e.g., schematics, manuals)? (Required)

Yes No

Upload the file below:

Please save all documentation into a .zip file first before uploading.

Additional Comments and Information

Do you have any additional information you would like to share for the assessment(s)?

Tell us about your environment

Field notes from the offensive side

How to Scope Your First Penetration Test

SOC 2 Pentest Requirements Explained

Penetration Testing Cost in 2026

Want to see a real report first?