Pentra
Professional penetration testing services

Penetration testing that ends with a report people actually use.

Pentra delivers web, API, cloud, and network assessments with a high-quality PDF report built for engineering remediation, SOC 2, ISO 27001, vendor reviews, and executive risk decisions.

Sample deliverable

Audit-grade SOC 2 or ISO 27001 PDF report

Download a sample report with executive summary, methodology, evidence, technical findings, remediation guidance, and retest-ready status.

Download sample report
PDF report preview

Harbor Cloud penetration test

Example report structure and finding format

Pentest report
Executive summary and risk narrative
Scope, dates, methodology, and access model
Findings table with severity, status, and affected assets
Severity rationale, business impact, and remediation guidance
Retest status and closure evidence for audit review
Web apps
APIs
Cloud IAM
Internal network
Services

Pentests for startups preparing to launch, fundraise, or pass security review.

We test the app, API, cloud, and network paths that could block a launch, slow a deal, or fail a vendor review.

Web application testing

Authentication, authorization, session handling, data exposure, file upload, business logic, and OWASP Top 10 coverage.

OWASPAuthMulti-tenant

API security testing

REST, GraphQL, and gRPC testing for IDOR, broken object authorization, mass assignment, injection, and rate-limit bypass.

RESTGraphQLgRPC

Cloud and infrastructure

Cloud IAM, external exposure, storage controls, Kubernetes, perimeter services, and practical privilege escalation paths.

AWSAzureGCP

Network penetration testing

External and internal network assessment covering perimeter exposure, Active Directory risk, lateral movement, and segmentation.

ExternalInternalAD
Methodology

A controlled workflow from authorization to retest.

The work is structured so engineering, leadership, and auditors can understand what was tested, what was found, and how to fix it.

01

Scope

Confirm targets, roles, environments, exclusions, rate limits, test windows, and escalation contacts.

02

Test

Combine focused automation with manual exploitation, authorization review, and sensitive workflow testing.

03

Report

Deliver validated findings with evidence, reproduction steps, impact, severity rationale, and fix guidance.

04

Retest

Re-run the original exploit path after remediation and document the final status for audit use.

Testing modes

Choose the level of access that fits your stage.

Startups usually need black-box external coverage or grey-box testing with real user roles. White-box review is available when a sensitive workflow needs deeper validation.

Black box

External attacker perspective with no internal documentation or credentials beyond agreed scope.

Grey box

Authenticated testing with test users, role coverage, and enough context to go deeper faster.

White box

Source-assisted review with architecture notes, admin access, and targeted validation of sensitive paths.

Reporting

The deliverable is a serious PDF report.

The final report is written to help engineers reproduce, prioritize, fix, and prove closure. It is also structured for vendor reviews, SOC 2 evidence, and ISO 27001 audit support.

Sample audit-grade PDF report

Example report structure and finding format

Executive summary and risk narrative
Scope, dates, methodology, and access model
Findings table with severity, status, and affected assets
Severity rationale, business impact, and remediation guidance
Retest status and closure evidence for audit review
Download the sample PDF

Findings & Research

High

Cross-tenant export exposed tenant records

Authorization checks failed when export jobs were requested through the API.

Medium

MFA bypass on invited admin flow

A role transition path allowed privileged access before the second factor was enforced.

Low

Webhook retry leaked internal error detail

Verbose responses exposed service names and queue identifiers useful for chaining.

Engagements

Pentesting packages for launch, audit, and ongoing security.

Pick the package that matches your stage. Each one includes validated findings, practical remediation guidance, and a PDF report your team can use for fixes and reviews.

Starter Pentest

Flat rate

$960

one-time

A focused fixed-price test for a narrow app, API, or critical user flow.

Best for

Early-stage products, narrow app/API scopes, and limited audit evidence needs

Output

Audit-grade PDF report usable for SOC 2, ISO 27001, and vendor reviews

Depth

Focused black-box penetration test

  • Black-box testing
  • OWASP Top 10 and access-control review
  • Validated findings with reproduction steps
  • One remediation retest for confirmed fixes
Start inquiry

Quarterly Pentest

Flat rate

$2,500

full year

Four focused tests across the year, scheduled one per quarter.

Best for

Teams that want recurring security checks and updated audit evidence

Output

Four quarterly PDF reports with fix verification notes and current risk summaries

Depth

One focused black-box or grey-box pentest per quarter for 12 months

  • Black-box and grey-box testing
  • Priority review of changed features
  • One test per quarter for four total tests
  • Simple evidence trail for audits and vendors
Start inquiry

Launch Readiness

Flat rate

$1,500

one-time

A practical go-live review for startups before launch, fundraising, or vendor review.

Best for

Startups about to launch a web app, API, marketplace, or customer portal

Output

Go-live risk report with launch blockers, quick wins, and retest status

Depth

Focused review of auth, payments, admin actions, uploads, and exposed cloud paths

  • Pre-launch threat model and scope review
  • Manual testing of highest-risk workflows
  • Clear launch-blocker prioritization
  • Founder-friendly readout and engineer-ready fixes
Start inquiry

Enterprise

Custom

Custom

pricing

Custom offensive security for larger scopes, complex environments, or ongoing testing.

Best for

Organizations with advanced offensive testing needs

Output

Continuous offensive security that scales with your organization

Depth

Custom testing windows across applications, cloud, network, and internal environments

  • Custom number of testers and testing windows
  • Support for apps on local networks
  • Priority support and response SLA
  • Training and onboarding
Request a Quote
FAQ

Frequently asked questions.

Direct answers about pricing, scope, reports, production testing, and what happens after findings are fixed.

Is the $960 starter package a real pentest?
Yes. Starter is a focused black-box pentest for early teams that need credible security evidence without a long procurement cycle. You get validated findings, reproduction steps, remediation guidance, and an audit-ready PDF report.
What do we get at the end?
You receive a PDF penetration test report with scope, dates, methodology, validated findings, evidence, reproduction steps, impact, remediation guidance, and retest status when applicable.
Can the report support SOC 2 or ISO 27001?
Yes. The report is structured for audit evidence and vendor security reviews, including the scope, testing window, methodology, access model, findings, evidence, remediation notes, and retest results.
What is the Launch Readiness package?
It is for startups about to go live. We focus on the workflows most likely to hurt the launch: authentication, authorization, payments, invites, admin actions, file upload, exposed APIs, and cloud exposure.
What does the $2,500 yearly package include?
It includes four focused pentests over 12 months, one per quarter. Each test produces updated findings and report evidence so your security posture does not go stale between audits, launches, or vendor reviews.
Do you only run scanners?
No. Scanners can help with coverage, but findings are manually validated before they are reported. The value is in access-control testing, exploitability checks, business logic review, and practical remediation guidance.
Can you test production?
Yes, when production is the right environment. We define safe payloads, rate limits, test windows, excluded actions, and escalation contacts before any production testing begins.
How fast can we start?
Most focused scopes can start once authorization, test accounts, target URLs, and safety rules are ready. If you are preparing for a vendor review or launch date, include the deadline in your inquiry.
Request a pentest

Start the conversation. We will take it from there.

Send a quick note and we will reply within 24 hours to understand what you need, what stage you are in, and which package makes sense.

Email
hello@pentra.tech
Response
We reply within 24 hours