Penetration testing that finds what scanners miss.

Hands-on testing of your apps, APIs, AI features, cloud, and networks, with a report for your auditor, customers, or insurer.

Get a fixed-fee quote See an example report
  • Fixed fee
  • Final report within 5 business days
  • One retest included
  • Our own US-based testers

Example · fictional company

Rated one at a time

  1. Stack trace on the export endpoint reveals the PDF renderer and its AWS host Low
  2. PDF renderer fetches attacker-supplied URLs (server-side request forgery) Medium
  3. Cloud metadata service reachable from the renderer (IMDSv1 enabled) Medium
  4. Export worker role can read and write every storage bucket, including database backups Medium

Rated as a chain: Critical Read and write access to production customer data

Rated one at a time, these are four separate low and medium issues. A tester connects them into one attack path.

  • 2023

    Founded in Austin, Texas

  • 30,000+

    members in HackNow’s hacking community

  • 100+

    penetration tests delivered by our testers over their careers, including engagements for partner security firms

Certifications held across our testing team

  • OSCP
  • CRTO
  • CISSP
  • CCSK
  • CompTIA PenTest+
See all certificationsTrust center

What’s driving your test?

First pen test, or not sure? Read the guide.

A scanner tells you what’s vulnerable. A tester tells you what’s exploitable.

We run automated tools on every pen test as a starting point. The most serious findings usually take a person who understands what your application is for.

Automated scanning

  • Finds known CVEs and common misconfigurations
  • Covers broad ground quickly

What a HackNow tester adds

Why it matters

31%

Verizon 2026 DBIR: “Exploitation of vulnerabilities is now the most common initial access vector for breaches. It has risen to 31%.”Source: Verizon Business, 2026 Data Breach Investigations Report: Executive Summary (2026) (PDF)

A report your engineers will actually use.

Each finding is verified by hand and written so a developer can reproduce it and fix it. Every report is reviewed by a second tester before delivery. Leaders get a plain-English summary. Auditors and customers get an attestation letter.

What a HackNow pen test report includes

  • Executive summaryOverall risk, key themes, and priorities, in plain language for leadership.
  • Technical findingsSeverity rating, CWE reference, affected assets, evidence, and reproduction steps for each one.
  • Attack narrativesHow separate issues chain together into real impact.
  • Remediation guidanceSpecific fixes for your stack, written for the engineers who will apply them.
  • Attestation letterThe test dates, scope, method, and results, to share with customers, auditors, or your insurer.
  • Retest resultsAn updated report and attestation letter once we’ve verified your fixes.

Methodology based on OWASP WSTG v4.2, ASVS 5.0, API Security Top 10 (2023), MASVS v2.1, Top 10 for LLM Applications (2025), PTES, NIST SP 800-115, and MITRE ATT&CK®.

See an example report

The example report on this site describes a fictional company. A sample report is available on request under NDA. Ask for it

Example finding 3.1 Fictional company Critical

Server-side request forgery exposes cloud credentials and customer data

Rated by the impact of the attack path at the top of this page.

CVSS 3.1
9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE
CWE-918 Server-Side Request Forgery
Affected
POST /v2/reports/export on api.example.com

Evidence

POST /v2/reports/export HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOi…
Content-Type: application/json

{"template":
  "<iframe src='http://169.254.169.254/latest/meta-data/iam/security-credentials/export-worker'></iframe>"}

Remediation

  • Treat template fields as text: escape user input before rendering, and turn off iframes and remote resource loading in the PDF renderer.
  • Require IMDSv2 on all instances and set the hop limit to 1.
  • Restrict the renderer’s outbound traffic to an allow-list of asset hosts.
  • Scope the export role to the single bucket it writes to.
See this finding’s reproduction steps

Six kinds of penetration test, each led by a tester.

Penetration testing

Manual testing of the systems attackers reach first.

  • Web applications

    Authenticated, manual testing of your web apps, from the login page to business logic.

    Example findingA regular user can approve their own refund.

  • APIs

    REST, GraphQL, gRPC, and WebSocket APIs tested for authorization flaws and data exposure.

    Example findingChanging /users/1043 to /users/1044 returns another customer’s profile.

  • Networks and Active Directory

    External perimeter, internal network, Active Directory, and on-site wireless testing.

    Example findingA help desk account is three steps from Domain Admins.

  • Cloud (AWS, Azure, Google Cloud)

    AWS, Azure, Google Cloud, and Kubernetes tested for misconfiguration and privilege escalation.

    Example findingA build server’s role can read every production bucket.

  • Mobile apps

    iOS and Android apps tested on instrumented devices: what they store, send, and trust.

    Example findingA client-side flag unlocks paid features.

  • AI and LLM applications

    Prompt injection, data leakage, and agent abuse testing for AI features and LLM applications.

    Example findingThe support bot can be talked into showing other customers’ tickets.

Adversary simulation

Find out whether your people and your detection would stop a real attack.

Assessment and training

Code and design review, vulnerability assessments, and hands-on training from working testers.

See all 11 services

What you can count on, from scoping to retest.

Here’s how a pen test runs and what we commit to at each stage.

  1. Reply within one business day

    Scope

    You get a fixed-fee proposal and written rules of engagement. Testing can usually start within 5 business days of signing.

  2. Typically 1 to 3 weeks

    Test

    All testing is performed by HackNow’s own US-based testers. We never pass your test to another firm. We work your targets by hand, backed by tooling.

    Critical findings within 24 hours of confirmation

    Critical findings are reported within 24 hours of confirmation, not held for the report.

  3. Within 5 business days after testing ends

    Report

    An executive summary for leadership and technical findings your engineers can act on, then a walkthrough call with your team. Final report delivered within 5 business days after testing ends.

  4. Within 90 days of the final report

    Retest

    One retest of reported findings within 90 days of the final report, included in the price. We verify each fix and issue an updated report and attestation letter.

Our six published commitments are written into our standard proposal. See all six

Get a fixed-fee quote

We started by teaching people to hack. We still do.

Hands-on hacking education came first, with a training platform and courses. Teaching shows in our reports: we explain why an issue happened as well as how to fix it.

Read our story

Common questions before an engagement

Anything else? Ask us directly.

How much does a penetration test cost?

Every engagement is a fixed fee after a free scoping call. Starting prices for the smallest scope: web applications from $5,000 per application (including its own API), external network tests from $5,000, APIs from $8,000 per API, AI features from $5,000, and cloud environments from $10,000 per environment. Your price depends on the applications, user roles, API endpoints, IP addresses, or cloud accounts in scope, and it won’t change once testing starts unless the scope does. One retest of reported findings within 90 days of the final report is included.

Starting prices in US dollars for the smallest scope of each service, reviewed October 2026. Your price is a fixed fee, set in a written proposal after a free scoping call.

See starting prices for every service

How long does a test take, and when can you start?

Testing can usually start within 5 business days of signing. Most web application, API, and network tests take one to three weeks of testing. Start dates are agreed during scoping, so tell us your deadline when you ask for a quote.

Isn’t a vulnerability scan enough?

A scan is automated: it checks your systems for known issues. A penetration test adds testers who confirm what’s actually exploitable, test authorization and business logic, and chain small issues into real attack paths. NIST SP 800-53 Rev. 5 (CA-8) says penetration testing “goes beyond automated vulnerability scanning.” We still run scanners in every pen test for breadth.

Source: NIST, SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, control CA-8 (2020) (PDF)

Read the full comparison

Who does the testing?

Our own US-based testers. We never pass your test to another firm. Each tester is an individual contractor engaged directly by HackNow, LLC under a written agreement. Certifications held across our testing team include OSCP, CRTO, CISSP, CCSK, and CompTIA PenTest+. Our testers have delivered 100+ penetration tests over their careers, including engagements for partner security firms.

Will testing disrupt production?

Testing is planned to avoid disruption. We agree on testing windows, source IP addresses, and emergency contacts before we start. Denial-of-service and destructive testing are never performed without written approval, and you can pause testing at any time with one message. If anything we do seems to affect a system, we stop testing and call your emergency contact before we continue. If you have a staging environment that mirrors production, we’re happy to test there.

What will our auditor, customer, or insurer get?

Reports document the scope, methodology, and dates that assessors typically look for. You also get an attestation letter to share with customers, auditors, or your insurer without handing over the full technical report. Your auditor decides what evidence it accepts. A sample report is available on request under NDA.

Ask for it See the example report, built on a fictional company

Is a retest included?

Yes. One retest of reported findings within 90 days of the final report is included in the price. We verify each fix and issue an updated report and attestation letter. Phishing campaigns don’t include a retest.

Can we sign an NDA first, and how do you handle our data?

Yes. We’ll sign a mutual NDA before scoping, or send ours. Evidence is handled under the confidentiality and retention terms in your contract, and we access sensitive data only as far as needed to prove impact.

Send an NDA before we discuss details How we handle your data

Can a penetration test find every vulnerability?

No test can promise that. A penetration test is a time-boxed assessment of the agreed scope at a point in time. We focus testing time where the risk is highest and report everything we confirm.

Find the way in before someone else does.

We reply to every request within one business day. Every engagement is a fixed fee after a free scoping call.

Get a fixed-fee quote Or see an example report