Pentest as a Service
Continuous, automated penetration testing tuned to your tier. Sign up, choose a plan, and start scanning in under two minutes.
From signup to first finding
Under two minutes, start to first vulnerability report.
Sign up
Create an account with your email in 30 seconds.
Choose a plan
Pick the depth that matches your risk profile.
Pay securely
Subscribe via Stripe. Cancel any time, no penalties.
Scan & remediate
Launch scans and apply ready-made fixes instantly.
Mapped to leading compliance frameworks
Choose your tier
Cancel any time. Upgrade or downgrade with one click.
Standard
Manual scans only
- Info & Low severity findings
- On-demand scans
- 3 active targets
- Security headers audit (CSP, HSTS, X-Frame, CORS)
- TLS/SSL certificate validation
- Cookie flags analysis (Secure, HttpOnly, SameSite)
- SPF, DMARC & CAA email security checks
- Server & framework version disclosure detection
- HTTP → HTTPS redirect & mixed-content check
- robots.txt & security.txt presence
- Basic PDF report export
- Email summary on scan completion
- Stealth port scan add-on
Medium
Weekly scheduled scans
- Everything in Standard
- Up to High severity findings
- Weekly automated scans
- XSS reflection & SQL error injection testing
- CSRF token detection on POST forms
- SSRF probe via URL/redirect parameters
- Path traversal canary probes
- Open redirect detection
- HTTP TRACE & write-method exposure
- Sensitive file exposure (.env, .git, backups)
- Stack trace & debug page detection
- OIDC/JWT alg:none & JWKS private key leak
- TLS cipher suite weakness analysis
- DNS zone transfer (AXFR) attempt
- MX, DNSSEC & DNS ANY amplification checks
- Mixed content & directory listing detection
- Admin panel & login surface exposure
- Subdomain takeover (CNAME dangling) detection
- Authentication rate limiting absence detection
- Token/secret leakage in URLs & response bodies
- SSL/TLS deep cipher analysis
- Detailed remediation reports
- 15 active targets
- Slack & Microsoft Teams alerts
- Scheduled scan management
- API token access
- Outbound webhooks
Pro
Continuous monitoring
- Everything in Medium
- All severities including Critical
- Continuous & hourly monitoring
- Default credential probing (admin/admin, root/root, etc.)
- RCE indicator probing (command output detection)
- XXE injection surface detection
- PHP & Java deserialization marker detection
- AWS key, GitHub token & private key exposure
- Subdomain takeover detection
- SSRF to cloud metadata endpoint (169.254.169.254)
- Compliance reports (OWASP / NIST)
- AI-powered narrative PDF reports
- Unlimited targets
- API tokens & outbound webhooks
- Dedicated security analyst
Secure payments by Stripe. Tax may apply. By subscribing you agree to our terms.
Full feature comparison
Every plan includes unlimited scans on covered targets. No hidden limits.
| Feature | Standard $49/mo | Medium $199/mo | Pro $499/mo |
|---|---|---|---|
| Scan frequency | On-demand | On-demand + daily | On-demand + continuous |
| Quick scan | |||
| Deep scan | |||
| Continuous monitoring | |||
| Severity levels | Info, Low | Info → High | Info → Critical |
| Port scanning (stealth) | |||
| Email scan reports | |||
| Scheduled scans | |||
| Slack / Teams alerts | |||
| Outbound webhooks | |||
| Compliance mapping (OWASP/NIST) | |||
| AI narrative PDF report | |||
| API token access | |||
| Unique targets | 3 active targets | 15 active targets | Unlimited targets |
Optional paid add-ons
These are separate purchases on top of your PTaaS subscription — not included in Standard, Medium, or Pro. Contact us to add any of these to your account.
Domain Health Monitor
Weekly automated checks of DNS records, WHOIS expiry, SSL certificate validity, and SPF/DMARC configuration. Get alerted before your domain lapses or your cert expires.
- SSL expiry alerts (30 / 7 / 1 day)
- WHOIS & domain expiry tracking
- SPF / DMARC / DKIM checks
- DNS change detection
Dark Web Monitoring
Continuously monitor breach databases and dark web sources for your domain's email addresses and credentials. Receive instant alerts when your staff appear in new data dumps.
- Email address breach detection
- Password hash monitoring
- Dark web forum alerting
- Monthly exposure report
Human Expert Review
A certified penetration tester manually reviews your latest scan report, annotates findings, and delivers a prioritized remediation roadmap within 48 hours.
- Manual validation of critical findings
- Annotated scan report
- Prioritized remediation roadmap
- 48-hour turnaround
Phishing Simulation
Simulated phishing campaigns against your organization to identify human risk. Track click rates, credential entry, and reporting behavior to drive security awareness training.
- Custom phishing templates
- Real-time click & capture tracking
- Employee risk scoring
- Training recommendation report
These add-ons are not included in any subscription tier. Each is an additional charge. Contact us at billing@vanquish.work to purchase or bundle for a discount.
What we test for
Coverage across the OWASP Top 10 and beyond, powered by a continuously updated vulnerability catalog.
7-Tool Network Security Suite
Every PTaaS subscription unlocks our full browser-based reconnaissance toolkit. No downloads, no extra charge — use it alongside your automated scans for deeper manual investigation.
Already subscribed?
Log in above and open the Network Scanner tab inside your dashboard.