Introduction
TurboPentest is an agentic AI pentest platform that runs 14 professional security tools against your web applications and infrastructure. It combines network reconnaissance, web application testing, and optionally source code analysis into a single pentest with unified findings.
What you get
Each pentest produces:
- Findings - Vulnerabilities ranked by severity (critical, high, medium, low, info) with CVSS scores, proof of exploit, and remediation guidance
- Retest validation - When you re-run a pentest, each previous finding is re-checked live against fresh evidence and its continuity status is updated (
new,confirmed, orretest_confirmed) - PDF report - Executive summary, methodology, and detailed findings for stakeholders
- Attestation letter - Formal letter confirming the pentest was performed, backed by SHA-256 report hashing and Merkle-tree verification with a public verification link and QR code (on-chain anchoring to Base L2 is on the roadmap)
- Attack surface map - Visual map of discovered assets and entry points
- Threat model - STRIDE-based analysis of your application
Black box vs white box
- Black box - 11 tools test your application externally (network, web app, SSL, WAF detection, etc.)
- White box - All black box tools plus 3 code analysis tools (SAST, SCA, secret detection) that require GitHub repository access
Beyond a single target, TurboPentest also provides Cloud EASM (authenticated multi-cloud asset discovery) and a dedicated AI/LLM security specialist for testing AI-powered features. See Core Concepts.
Pricing
TurboPentest uses a credit system. Each pentest consumes one credit. Credits can be purchased individually (starting at $99 for the Audit-Ready tier), in bulk with volume discounts of 10-30% (at 10, 50, and 100+ credits), or via annual subscriptions paid upfront with 10-20% discounts. Credits can also be transferred between users.
See Pricing for the full schedule.