What we test

All what we test

Web applicationAuthenticated testing of a web application against the logic an attacker would actually abuse: who can reach what, whose data is whose, and what happens when a request arrives out of order.
APITesting the API as the primary attack surface rather than as plumbing behind a user interface, including the endpoints the interface never calls.
Cloud infrastructureTesting the cloud account itself: what an attacker reaches after one credential leaks, and how far identity and network configuration let them go.
External and internal networkTesting the network perimeter from outside, and the internal network as though a foothold has already been established. PCI DSS requires both; most other frameworks are satisfied with the external half.
AI and LLM featuresTesting the AI surface of a product as a security surface: where untrusted content reaches a model, what the model is allowed to do with tools, and what a crafted input can make happen.

Audits

SOC 2SOC 2 is an attestation report produced by a licensed CPA firm against the AICPA Trust Services Criteria. It is the report most North American enterprise buyers ask a software vendor for.
SOC 2 Type IA SOC 2 Type I reports on whether controls are suitably designed at a single point in time. It is a snapshot, and it is the fastest route to having a report to hand a customer.
SOC 2 Type IIA SOC 2 Type II reports on whether controls operated effectively across an observation window, usually three to twelve months. It is the report most enterprise procurement teams treat as the real one.
ISO 27001ISO/IEC 27001 is a certifiable standard for an information security management system. Unlike SOC 2 it produces a certificate rather than a report, and it is the assurance European and Asian buyers usually ask for first.
PCI DSSPCI DSS is the card brands' security standard for anyone who stores, processes or transmits cardholder data. It is the one framework on this list that requires penetration testing in so many words.
HIPAAThe HIPAA Security Rule sets safeguards for electronic protected health information. It applies to covered entities and to business associates, which is how most health technology startups are caught by it.
FedRAMPFedRAMP is the authorization program a cloud service must pass to be sold to United States federal agencies. It is the most demanding framework on this list and the most expensive to reach.
GDPRGDPR is the European Union's data protection regulation. Its security obligation is short, outcome-based, and explicitly asks for regular testing of the measures an organization relies on.
CMMCCMMC is the Department of Defense's certification program for contractors handling federal contract information and controlled unclassified information. Levels 1 through 3 set progressively stricter requirements.
HITRUSTHITRUST CSF is a certifiable framework that maps many other standards into one control set. It is most common in healthcare, where large payers and health systems ask for it by name.
SOC 3A SOC 3 is a short, general-use report built from the same audit work as a SOC 2. It contains no detailed control descriptions or test results, which is exactly why it can be published on a public website.
NIST CSFThe NIST Cybersecurity Framework is a voluntary structure for organizing a security program. Version 2.0, published in 2024, added Govern to the original five functions and broadened the audience beyond critical infrastructure.
ISO 42001ISO/IEC 42001 is the first certifiable standard for an artificial intelligence management system. It sits alongside ISO 27001 in structure and is starting to appear in enterprise diligence for companies that ship AI features.
NIS2NIS2 is the European Union's cybersecurity directive for essential and important entities. Unlike a regulation it is transposed into national law by each member state, so the specifics vary by country.
DORADORA is the European Union's operational resilience regulation for the financial sector. It is the only framework here that mandates threat-led penetration testing by name, for the entities designated to perform it.

Compare

SOC 2 vs ISO 27001SOC 2 and ISO 27001 are the two assurance standards a growing software company is asked for. They overlap heavily in what they require and differ almost entirely in what they produce and who asks for them.
SOC 2 Type I vs Type IIThe difference between the two SOC 2 report types is time, and that single difference changes cost, credibility and how you schedule a penetration test.
Penetration test vs vulnerability scanThe two are routinely confused, sometimes by vendors selling one as the other. They answer different questions and most compliance frameworks expect both.
Black box vs grey box vs white box testingBlack, grey and white box describe how much context the tester starts with. The choice changes what a fixed budget buys, and it is where the most money is wasted.
What a penetration test costs, and why quotes vary so muchPenetration test pricing varies by an order of magnitude for work that is often comparable. Understanding which inputs actually move the number makes the range explainable.

Learn

ArticlesGuides on testing, audits and evidence.
GlossaryPlain definitions of audit and testing terms.
AI vulnerabilitiesDocumented AI and agent security cases, with sources.
How we workWhat happens between signing and the report.

Pricing Contact

Web application
API
Cloud infrastructure
External and internal network
AI and LLM features

SOC 2
SOC 2 Type I
SOC 2 Type II
ISO 27001
PCI DSS
HIPAA
FedRAMP
GDPR
CMMC
HITRUST
SOC 3
NIST CSF
ISO 42001
NIS2
DORA

SOC 2 vs ISO 27001
SOC 2 Type I vs Type II
Penetration test vs vulnerability scan
Black box vs grey box vs white box testing
What a penetration test costs, and why quotes vary so much

Articles
Glossary
AI vulnerabilities
How we work

Pricing Contact Sign in

Contact

Scope an assessment

Four fields and a description of what is in scope. You get a fixed price and the earliest start date within one business day.

Name

Work email *

Company

Website

What is driving this

What is in scope

The more specific this is, the more accurate the price comes back.

We use this to reply to you. No marketing list, no tracking cookie, no third party.

What you get back

A fixed price, from $3,000 to $5,450 depending on scope and speed
The earliest date testing can start
A list of the access we need on day one
Rules of engagement to review before anything is signed

Prefer to read first?

Published pricing
What your framework requires
How an engagement runs

Or email hello@clearpentest.com.

Penetration testing

Web application
API
Cloud infrastructure
External and internal network
AI and LLM features

Audits and frameworks

SOC 2
SOC 2 Type I
SOC 2 Type II
ISO 27001
PCI DSS
HIPAA
FedRAMP
GDPR
CMMC
HITRUST
SOC 3
NIST CSF
ISO 42001
NIS2
DORA

SOC 2 vs ISO 27001
SOC 2 Type I vs Type II
Penetration test vs vulnerability scan
Black box vs grey box vs white box testing
What a penetration test costs, and why quotes vary so much

Articles
Glossary
AI vulnerabilities
How we work

ClearPenTest© 2026 ClearPenTest

Privacy Terms Security hello@clearpentest.com