You authorize the target
Pay, then confirm you own the hostname or have written permission. Testing does not start until consent and verification are complete.
Automated Penetration Test
Automated Penetration Test $297
You must own the target or have written permission to test it. Automated evidence-backed testing with HTML, PDF, and one included retest. Usually 30 to 60 minutes after testing starts.
Included
What you get
Automated evidence-backed testing with HTML, PDF, and one included retest
Confirm the engagement plan
Review what will run. Active engines wait until you confirm. Start now or schedule a window with timezone and blackouts.
HTML and PDF for specialists
A do-this-week list, ticket-ready findings, and evidence. Not a consultant letter and not a compliance certificate.
Included retest
The $297 tier includes one targeted retest. The $497 tier includes two. Full refund until testing starts.
- Verified target and authorization consent before testing
- Review and confirm the automated engagement plan
- Usually 30 to 60 minutes after testing starts
- HTML and PDF with a do-this-week list and ticket-ready findings
- One included targeted retest with before and after evidence
- Full refund until testing starts
- Optional authenticated checks with a saved healthy scanner profile
Wrapped industry engines
The same catalog wraps Nuclei, OWASP ZAP, SQLMap, and Playwright. Vulnify owns confirmation, evidence, and the report. These names are not partner badges.
- Nuclei
- OWASP ZAP
- SQLMap
- Playwright
Names identify software we wrap. No affiliation or endorsement.
How testing works
Automated penetration test methods
Published engines, OWASP-aligned checks, and a specialist PDF — not a tools roundup.
This automated penetration test runs hosted engines against the hostname you authorize. Coverage is web-application focused: injection, cross-site scripting, exposed paths, headers, and related OWASP-style checks. Vulnify confirms findings, attaches evidence, and writes ticket-ready remediation. It is not a network CVE scanner and not a certified audit.
If you only need a free public check first, start with the website vulnerability scanner or a free security scan. Order this $297 automated penetration test when you want HTML and PDF plus one retest on a target you own.
How it runs
From order to report
Pay, consent, verify, confirm the plan, then receive HTML and PDF.
Pay and authorize
Order this tier, then confirm you own or are authorized to test the hostname.
Verify the target
Prove control of the primary hostname before any active testing starts. Comprehensive extra hosts stay out of scope until you verify them or continue primary-only.
Attach login profiles when needed
A healthy scanner login profile enables authenticated families. Skip it and those checks are not tested. Comprehensive can add a second profile for the two-role matrix.
Confirm the plan, then start or schedule
Review the automated engagement plan. Engines do not start until you confirm. Full refund remains available until they do.
Report and retest
Usually 30 to 60 minutes after testing starts. HTML and PDF include numbered remediation. Included retests depend on the tier you ordered.
Proof
See a sample report
Same structure as the deliverable for this tier. Sample data only.
Limits
What this is not
Honest limits so you order the right product.
Automated, not a human consultant
Automated evidence-backed testing — not a human consultant. Vulnify wraps published engines and owns confirmation, evidence, and the report.
Not a certified audit
This is an automated, evidence-backed assessment. It is not a PCI DSS, SOC 2, ISO 27001, or certified penetration test, and it is not a human consultant letter.
Refunds stop when engines start
Full refund until testing starts. After engines start, use request stop instead of a refund.
Need extra hosts, extra engines, or two retests? Comprehensive Pentest — $497 · Website Security Scanner · Website Watch · How to scan a website for vulnerabilities · OWASP Top 10 explained · SAST vs DAST vs SCA · Cookie security explained · SSRF explained · Vulnify home
FAQ
Automated Penetration Test FAQ
Authorization, timing, and how this tier differs from the other pentest.
An automated penetration test on Vulnify is evidence-backed testing of a hostname you own or are authorized to test. The $297 tier wraps published engines, then you receive HTML and PDF plus one included retest. Reports are usually ready 30 to 60 minutes after testing starts. It is not a human consultant letter and not a PCI, SOC 2, or ISO certificate.
Order the Penetration Test
$297. Usually 30 to 60 minutes after testing starts. You must own the target or have written permission.