Ciphrix
Built by AWS Security Leaders

AI-powered Penetration Testing

AI-powered penetration testing that understands your application before the first security test is executed.

Book AssessmentView Pricing
Starts From A$2,000AI-Powered. Human Validated.Fixed PricingAudit-Ready Reports
AI penetration testing dashboard showing security assessment results and findings
The Old Way

Traditional penetration testing was built for a slower world.

Growing companies need credible security evidence, not a six-week enterprise consulting engagement. Ciphrix has you covered with AI-assisted discovery, expert human validation, fixed pricing and audit-ready reports.

Problem

Cost

Traditional penetration tests often cost $10,000-25,000+, putting credible security validation out of reach for many growing teams.

Problem

Time

Manual scoping, testing, reporting and retesting can stretch across 6-10 weeks, slowing customer reviews, audits and go-live timelines.

Problem

Overkill

Most teams and organizations do not need a large bespoke consulting engagement every time a customer, auditor or buyer asks for security evidence.

How it Works

Ciphrix AI Security Engine

Traditional penetration testing begins with scanning. Ciphrix begins with understanding.

AI agents continuously collaborate to understand, plan, test, validate and correlate findings throughout the assessment.

Understand

Architecture

Source code

Runtime explore

Map + Test

AI Attack Surface Graph

Threat Modelling Agent

Architecture agent

Threat agent

Attack agent

Exploit agent

Correlation agent

Report agent

Validate + Deliver

Human validation

Evidence

Risk assessment

Audit report

Why It Works

Built on proven security practice.

The Ciphrix AI Security Engine combines recognised security methodologies, comprehensive attack-surface coverage, enterprise-grade tooling and expert human validation to deliver consistent, evidence-rich security assessments.

Framework methodology
OWASP threat modeling
STRIDE
OWASP ASVS
MITRE ATT&CK
Testing standards
OWASP Top 10
OWASP API Security Top 10
NIST 800-115
SANS testing practices
Attack surface coverage

Authentication

  • Login/logout
  • MFA and 2FA
  • Password policies
  • Account lockout

Authorization

  • BOLA / IDOR
  • Privilege escalation
  • Horizontal access
  • Vertical access

Input and injection

  • SQL injection
  • NoSQL injection
  • Command injection
  • XXE / XSS / CSRF

Data protection

  • Sensitive data exposure
  • Encryption issues
  • Insecure storage
  • Data leakage

Session management

  • Session fixation
  • Session hijacking
  • Token validation
  • Logout invalidation

API security

  • API discovery
  • AuthN and AuthZ
  • Rate limiting
  • Mass assignment

Business logic

  • Workflow abuse
  • Race conditions
  • Logic flaws
  • Abuse of functionality

Configuration and infra

  • Security headers
  • CORS misconfig
  • Cloud storage
  • Hardening issues
Enterprise-grade tooling
Burp Suite
Metasploit
Nuclei
Nessus
Shodan
Proprietary AI engine
Backed by expertise
OSCP
OSWE
CREST certified
Bugcrowd researchers
HackerOne contributors
10+ yrs avg. experience
Our Capabilities

Comprehensive security testing from a single assessment.

Every engagement combines multiple security disciplines to deliver a complete understandingof your application's security posture.

Capability

Web Penetration Testing

Authenticated testing of web applications and APIs against real attack scenarios.

Capability

AI-assisted Code Review

Identify insecure coding patterns, secrets and vulnerable dependencies.

Capability

Security Architecture Review

Assess trust boundaries, authentication models and application design.

Capability

Threat Modelling

Identify likely attack paths before attackers do.

Capability

Network Penetration Testing

Assess externally exposed infrastructure and network services.

Capability

Human Validation

Every significant finding is reviewed before it reaches your report.

Simple, Transparent Pricing

Our Services

Choose the security service that fits your immediate needs. Fixed starting prices keep scope clear, with enterprise engagements quoted separately.

Human ValidationFixed PricingAI-Assisted AssessmentAudit-Ready Reports

Selected service

Web Penetration Testing

Authenticated testing for web applications, SaaS products, customer portals, internal tools and APIs.

Currency

Package 01

Small Web Test

Price

A$2,000

Best for

Ideal for focused web applications, customer portals, internal tools and early-stage software products.

Includes

  • 1 authenticated user type
  • Human-validated assessment
  • AI-assisted testing
  • Audit-ready report
  • One complimentary retest
Most popular

Package 02

Medium Web Test

Price

A$4,000

Best for

Ideal for most production web applications and commercial software products with multiple features, APIs and authenticated users.

Includes

  • 1 authenticated user type
  • Human-validated assessment
  • AI-assisted testing
  • Audit-ready report
  • One complimentary retest

Package 03

Large Web Test

Price

A$6,000

Best for

Ideal for mature web applications and mid-market software platforms with broader functionality, integrations and testing requirements.

Includes

  • Up to 2 authenticated user types
  • Human-validated assessment
  • AI-assisted testing
  • Audit-ready report
  • One complimentary retest

Enterprise or not sure?

Enterprise / Custom

If your application serves millions of users, spans multiple products or environments, or needs bespoke assurance, contact us for a tailored quote.

AI-native security testing engine

Agents understand your application context before test execution begins.

Human-validated findings

Experienced security engineers review significant issues before they reach you.

Fixed-price engagements

Clear starting prices and defined scope without open-ended consulting ambiguity.

Detailed findings

Findings include impact, evidence, risk rating, and remediation guidance.

Retest included

One retest helps verify fixes and close customer or internal requirements.

Audit-ready reports

Reports support ISO 27001, SOC 2, HIPAA, customer reviews, and security questionnaires.

Why Ciphrix

AI speed, human confidence.

Penetration testing that is fast enough for modern release cycles and strong enough for customer reviews, audits, and board-level risk conversations.

FAQ

Frequently asked security assessment questions.

Which security service should I choose?
Choose Web Penetration Testing for web applications and APIs, Network Penetration Testing for internet-facing infrastructure, Architecture Review & Threat Modelling for design-level security review, and Secure Code Review for source code security issues.
How do I choose between Small, Medium and Large?
Small is for focused applications, straightforward environments or single services. Medium fits most production systems with more features, components or exposed services. Large is for broader platforms, larger environments, multiple trust boundaries or higher assessment effort.
What if I choose the wrong size?
If you are unsure, choose the closest tier or contact us before booking. We confirm scope before work begins and can help move you to the right package if the selected size does not match your application, environment or codebase.
What if we're smaller than Small?
Small is designed for focused, early-stage or straightforward scopes. If your need is even narrower, contact us and we can confirm whether the Small package still fits or whether a lighter custom scope makes more sense.
What if my scope does not fit Small, Medium or Large?
If your environment is business-critical, highly regulated, spans multiple products or environments, or does not fit the listed tiers, choose Enterprise / Custom and we will scope it separately.
Are the listed prices fixed?
Yes. The listed package prices are fixed for the scope shown in each tier. Enterprise environments, multiple applications, unusually large codebases and bespoke scopes are quoted separately before work begins.
What is included in every engagement?
Every engagement includes human validation, AI-assisted assessment, an executive summary, technical findings, risk ratings and remediation recommendations.
What is excluded unless explicitly quoted?
Multiple applications, enterprise environments, internal network testing, source code review for web penetration tests, security architecture review and threat modelling are excluded unless explicitly included in the quoted scope.
How does AI fit into the assessment?
AI assists with application understanding, attack planning, discovery and correlation. Every significant finding is reviewed by an experienced security engineer before it is included in the final report.
Is this fully automated?
No. Our assessments combine AI-powered testing with human validation to reduce false positives while maintaining high-quality findings.
Do you test authenticated areas?
Yes. Authenticated web application testing is included in the web penetration testing packages. Small and Medium include 1 authenticated user type, while Large includes up to 2 authenticated user types.
Is secure code review included in web penetration testing?
No. Secure Code Review is a separate service unless it is explicitly included in a custom quote. Web Penetration Testing focuses on the running application and its exposed behaviour.
Is architecture review or threat modelling included in penetration testing?
No. Security Architecture Review & Threat Modelling is a separate service unless it is explicitly included in a custom quote. It is useful before development, before release, or alongside a broader security assessment.
How long does an assessment take?
Timelines depend on the selected service, tier and readiness of access details. Smaller, focused engagements are usually faster, while Large and Enterprise scopes are confirmed during scoping.
What do you need from us?
For web testing we typically need target URLs, test credentials and application context. For network testing we need target IPs or hosts. For architecture review we need diagrams or design notes. For code review we need repository access or a code export.
Can you test production environments?
Yes, provided the assessment is authorised and appropriate precautions are agreed beforehand.
Will the testing impact our application?
Our testing is designed to minimise disruption. Some security tests may temporarily increase traffic or trigger defensive controls, so we coordinate production assessments in advance.
What report will we receive?
You'll receive an executive summary, technical findings, supporting evidence, risk ratings, remediation guidance and an audit-ready report suitable for enterprise customers and compliance audits.
Which security standards do you follow?
Our methodology aligns with OWASP Top 10, OWASP API Security Top 10, NIST SP 800-115, SANS Security Testing Practices and STRIDE Threat Modelling.
Can this help with compliance?
Yes. Many customers use our reports to support security requirements for ISO 27001, SOC 2, HIPAA and customer security questionnaires.
Do you sign NDAs?
Yes. We are happy to sign mutual NDAs before commencing an engagement.
Do you offer recurring testing?
Yes. Security testing can be scheduled quarterly, biannually or annually, or after major application releases.

Still have questions?

Talk to one of our security engineers.

Book AssessmentContact Us
Get started

Ready to test your application?

Get a fixed-price security assessment with AI-powered testing, human validation and actionable security findings.

Book Assessment
Explore more:PricingContact Us

Built by AWS Security Leaders | AI-powered security testing | Human-validated reports