Four standing engagement tiers, priced on the record. Every engagement includes a detailed report and expert recommendations. Custom engagements available for non-standard situations.
Standing Engagements
For the founder who shipped fast with AI tools and needs to know what they actually shipped.
Delivery
1 week from kickoff
Best for
Pre-launch SaaS, recently-shipped MVPs, vibecoded apps
The full adversarial assessment. What a serious buyer expects when they ask "have you been pentested?"
Delivery
2-3 weeks from kickoff
Best for
SaaS preparing for SOC 2, pre-fundraise due diligence, investor security review
A standing security desk for teams that ship continuously and need coverage that ships with them.
Delivery
Ongoing commitment
Best for
$20K+ MRR SaaS, continuous shipping velocity, regulated industries
For engagements that don't fit a template: multi-system assessments, due diligence, regulatory response.
Delivery
Custom timeline
Best for
Situations where standard tiers don't fit. Contact us to scope.
Frequently Asked
No. We don't sell automated scanning as a standalone service. Every Cyber Pantheon engagement includes automated scanning as part of the methodology, but our value is in the manual review and exploitation validation that scanners can't do. If you only want a scan, we recommend running nuclei (free, open-source) or a SaaS tool like Snyk.
Because The Vibe Check isn't a scan. It's 5-8 hours of senior correspondent time manually reviewing your highest-risk surfaces. A $200 scan finds CVEs in dependencies. The Vibe Check finds the IDOR that lets User A read User B's data — which is what actually causes breaches.
Probably not directly. Our floor is $1,500 because below that we can't deliver the quality we stand behind. If budget is the constraint, we recommend a freelancer on Toptal or Codementor — happy to refer. If you want to wait until you can afford the $1,500 Vibe Check, we'll be here.
Nothing — The Field Report is what you submit to your SOC 2 auditor as your annual penetration test. Same methodology (OWASP WSTG v4.2), same report format, same re-test window. We've delivered this for SOC 2, HIPAA, ISO 27001, and PCI-DSS compliance contexts.
No. A clean report is the most valuable deliverable we provide — it means your engineering team did the work up front. We don't discount "no findings" engagements because the work to validate that nothing is wrong is identical to the work to find that something is wrong.
For The Vibe Check: typically within 5 business days of signed SOW + deposit. For The Field Report: within 10 business days. For The Standing Beat: within 2 weeks of signed agreement. For Bureau Engagements: depends on scope.
Yes, standard mutual NDA before any technical discussion. We can use yours or ours.
Not currently. We specialize in web application security for SaaS and small-team products. If you need smart contract auditing, we recommend Trail of Bits, OpenZeppelin, or Spearbit.
Still Unsure?
Schedule a 30-minute briefing with our team. We'll walk through your specific needs and recommend the right engagement.
