Pentest Tiers

Understanding Pentest Tiers

Every pentest on TurboPentest consumes one credit, but not all credits are equal. Credits come in four tiers that determine how long Paladin's AI agents work on your target and how many agents are deployed. The tier you choose directly affects the depth, breadth, and thoroughness of the pentest.

Think of tiers as the difference between a quick security check and a full-scale penetration test. Each tier is designed for specific use cases, and choosing the right one depends on your goals, timeline, and budget.

The Four Tiers

Recon ($49 / 0.5 Agent Hours)

Recon is the entry-level tier designed for quick surface-level assessments. It runs all Phase 1 tools for comprehensive reconnaissance and provides a brief AI analysis of the findings. Agent hours are limited to 0.5 hours (one agent for 30 minutes), which means Paladin performs a rapid triage of the reconnaissance data rather than deep exploit validation.

Best for:

• Quick checks after minor deployments
• Initial assessment of a new target before committing to deeper testing
• Verifying that a specific fix was deployed correctly
• Budget-conscious monitoring of low-risk applications

What you get: Full Phase 1 tool output, basic AI-analyzed findings with severity ratings, and a summary report. Agent validation is limited - findings are assessed but not all are exploit-validated.

Standard ($99 / 4 Agent Hours)

Standard is the recommended tier for most external pentests. With 4 agent hours, Paladin deploys 4 agents (a supervisor plus 3 specialists covering Web, API, and Infrastructure) that have enough time to validate findings, test exploit scenarios, and document proof-of-concept attacks.

Best for:

• Regular scheduled pentests of production applications
• Full external penetration testing
• Teams that need validated findings with PoC exploits
• The core of most organizations' pentest programs

What you get: Full Phase 1 reconnaissance, a supervisor plus 3 specialists with validated findings, proof-of-concept exploits for confirmed vulnerabilities, Docker retest commands, and a comprehensive report with attestation letter.

Deep ($299 / 20 Agent Hours)

Deep tier raises the agent time to 20 hours and deploys 10 agents: a supervisor plus 9 specialists. Beyond Standard's Web, API, and Infrastructure, Deep adds Code Analysis, Cryptography, Authentication, Business Logic, Supply Chain, and AI/LLM Security specialists, with more time for each agent to investigate complex attack paths.

Best for:

• Applications handling sensitive data (financial, healthcare, PII)
• Pre-audit pentests where thoroughness is critical
• Complex applications with multiple authentication flows
• Targets where you suspect deep or chained vulnerabilities

What you get: Everything in Standard plus the full 9-specialist lineup, deeper investigation of complex findings, more thorough exploit chain discovery, and extended coverage of authentication, cryptographic, code, business-logic, supply-chain, and AI/LLM vulnerability domains.

Blitz ($699 / 80 Agent Hours)

Blitz is the maximum-depth tier. It deploys all 9 specialists plus depth agents (which perform a second, deeper pass on breadth-phase findings), an Exploit Chain Agent (which specifically hunts for multi-step attack paths), and a Verification Agent (which confirms severity ratings and PoC reproducibility), for 20 agents in total (including the supervisor). With 80 agent hours, this tier approaches the thoroughness of a manual penetration test.

Best for:

• Mission-critical applications where security is paramount
• Compliance pentests requiring maximum coverage evidence
• Applications preparing for third-party security audits
• When you need the closest thing to a manual pentest with automated speed

What you get: Everything in Deep plus depth agents for second-pass analysis, an Exploit Chain Agent for multi-step attack paths, a Verification Agent for quality control, and the most comprehensive report and attestation available.

Agent Hours Explained

Agent hours represent the total compute time allocated to Paladin's AI agents during Phase 2. This is separate from Phase 1 tool execution, which runs regardless of tier. Agent hours are distributed across all deployed agents - so a Standard pentest with 4 agents and 4 hours gives roughly 1 hour per agent, while Blitz with its larger agent pool distributes 80 hours across a larger team.

More agent hours means each agent can investigate more leads, test more exploit variations, and follow more complex attack paths. It is the difference between an agent that tests the three most obvious SQL injection payloads and one that crafts twenty custom payloads targeting the specific database engine and WAF configuration it has detected.

Credit Costs and Planning

For organizations buying in bulk, one-time volume discounts of 10%, 20%, and 30% apply at 10, 50, and 100 credits. Annual subscriptions (billed upfront, with all credits delivered immediately) bundle credits at a discount: Audit-Ready (12 Standard credits, 10% off), Threat-Hunt (12 Deep credits, 15% off), and Pro (8 Deep plus 4 Blitz credits, 20% off).

Choosing the Right Tier

Start with Standard for your primary application. If the results reveal complex findings that warrant deeper investigation, upgrade to Deep or Blitz for the next run. Use Recon for quick post-deployment checks and low-risk applications. Reserve Blitz for your most critical assets or pre-audit preparation.

Many organizations use a mixed approach: weekly Standard pentests for ongoing coverage, monthly Deep pentests for thorough analysis, and quarterly Blitz pentests as the comprehensive security baseline. This strategy balances cost, coverage, and depth across the year.

The tier does not affect Phase 1 tool execution - all 11 (black-box) or 14 (white-box) tools run at every tier. The difference is entirely in Phase 2: how many agents are deployed, how long they work, and whether specialized agents like the Exploit Chain Agent and Verification Agent are included.