---
title: "Pentest Tiers"
description: "Learn how to choose the right pentest tier - Recon, Audit-Ready, Threat-Hunt, or Adversarial-Depth (slugs recon/standard/deep/blitz) - based on agent hours, depth requirements, and credit costs."
canonical: https://turbopentest.com/learn/environment-setup/scan-tiers
source: "TurboPentest Learn"
---

# Pentest Tiers

## Understanding Pentest Tiers

Every pentest on TurboPentest consumes one credit, but not all credits are equal. Credits come in four tiers that determine how long Paladin's AI agents work on your target and how many agents are deployed. The tier you choose directly affects the depth, breadth, and thoroughness of the pentest.

Think of tiers as the difference between a quick security check and a full-scale penetration test. Each tier is designed for specific use cases, and choosing the right one depends on your goals, timeline, and budget.

## Tier Names: Slugs vs. Display Names

Each tier has a canonical slug and an outcome-named display label. The canonical slugs - `recon`, `standard`, `deep`, and `blitz` - are what the API `tier` parameter and product URLs use. The display names sit on top of those slugs:

| Slug | Display name |
|------|--------------|
| `recon` | Recon |
| `standard` | **Audit-Ready** |
| `deep` | **Threat-Hunt** |
| `blitz` | **Adversarial-Depth** |

Throughout this lesson we show both so you can recognize a tier whether you see it in the dashboard (display name) or in an API call (slug).

## The Four Tiers

### Recon ($49 / up to 0.5 Agent Hours)

Recon is the entry-level tier designed for quick surface-level assessments. It is offered as a free preview rather than sold publicly, but it still runs a full Phase 1 and a Phase 2 pass. It runs all Phase 1 tools for comprehensive reconnaissance and then deploys **one generalist agent** in Phase 2. Agent hours are capped at up to 0.5 (a single generalist agent running for a matter of minutes), which means Paladin performs a rapid triage of the reconnaissance data rather than deep exploit validation. Recon is not "Phase 1 only" - it still runs an agent, just a single generalist with no supervisor.

**Best for:**
- Quick checks after minor deployments
- Initial assessment of a new target before committing to deeper testing
- Verifying that a specific fix was deployed correctly
- Budget-conscious monitoring of low-risk applications

**What you get:** Full Phase 1 tool output, basic AI-analyzed findings with severity ratings, and a summary report. Agent validation is limited - findings are assessed but not all are exploit-validated.

### Audit-Ready ($99 / up to 4 Agent Hours)

Audit-Ready (slug `standard`) is the recommended tier for most external pentests. With up to 4 agent hours, Paladin deploys 4 agents (a supervisor plus 3 specialists covering Web, API, and Infrastructure) that have enough time to validate findings, test exploit scenarios, and document proof-of-concept attacks.

**Best for:**
- Regular scheduled pentests of production applications
- Full external penetration testing
- Teams that need validated findings with PoC exploits
- The core of most organizations' pentest programs

**What you get:** Full Phase 1 reconnaissance, a supervisor plus 3 specialists with validated findings, proof-of-concept exploits for confirmed vulnerabilities, read-only reproduction steps for each finding, and a comprehensive report with attestation letter.

### Threat-Hunt ($299 / up to 20 Agent Hours)

Threat-Hunt (slug `deep`) raises the agent time to up to 20 hours and deploys 10 agents: a supervisor plus 9 specialists. Beyond Audit-Ready's Web, API, and Infrastructure, Threat-Hunt adds Code Analysis, Cryptography, Authentication, Business Logic, Supply Chain, and AI/LLM Security specialists, with more time for each agent to investigate complex attack paths.

**Best for:**
- Applications handling sensitive data (financial, healthcare, PII)
- Pre-audit pentests where thoroughness is critical
- Complex applications with multiple authentication flows
- Targets where you suspect deep or chained vulnerabilities

**What you get:** Everything in Audit-Ready plus the full 9-specialist lineup, deeper investigation of complex findings, more thorough exploit chain discovery, and extended coverage of authentication, cryptographic, code, business-logic, supply-chain, and AI/LLM vulnerability domains.

### Adversarial-Depth ($699 / up to 80 Agent Hours)

Adversarial-Depth (slug `blitz`) is the maximum-depth tier. It deploys all 9 specialists plus depth agents (which perform a second, deeper pass on breadth-phase findings), an Exploit Chain Agent (which specifically hunts for multi-step attack paths), and a Verification Agent (which confirms severity ratings and PoC reproducibility), for 20 agents in total (including the supervisor). With up to 80 agent hours, this tier approaches the thoroughness of a manual penetration test.

**Best for:**
- Mission-critical applications where security is paramount
- Compliance pentests requiring maximum coverage evidence
- Applications preparing for third-party security audits
- When you need the closest thing to a manual pentest with automated speed

**What you get:** Everything in Threat-Hunt plus depth agents for second-pass analysis, an Exploit Chain Agent for multi-step attack paths, a Verification Agent for quality control, and the most comprehensive report and attestation available.

## Agent Hours Explained

Agent hours represent the total compute time budgeted for Paladin's AI agents during Phase 2 - a ceiling, not a fixed run length; agents stop sooner when the work is done. This is separate from Phase 1 tool execution, which runs regardless of tier. Agent hours are distributed across all deployed agents - so an Audit-Ready pentest with 4 agents and up to 4 hours gives roughly 1 hour per agent, while Adversarial-Depth with its larger agent pool distributes up to 80 hours across a larger team.

More agent hours means each agent can investigate more leads, test more exploit variations, and follow more complex attack paths. It is the difference between an agent that tests the three most obvious SQL injection payloads and one that crafts twenty custom payloads targeting the specific database engine and WAF configuration it has detected.

## Credit Costs and Planning

| Tier (display / slug) | Price | Agent Hours | Agents | Best Use Case |
|------|-------|-------------|--------|---------------|
| Recon / `recon` | $49 | up to 0.5 hours | 1 generalist agent | Quick checks, monitoring (free preview) |
| Audit-Ready / `standard` | $99 | up to 4 hours | 4 agents | Regular pentesting |
| Threat-Hunt / `deep` | $299 | up to 20 hours | 10 agents | Sensitive apps, pre-audit |
| Adversarial-Depth / `blitz` | $699 | up to 80 hours | 20 agents (specialists + depth, chain, verification) | Mission-critical, compliance |

For organizations buying in bulk, one-time volume discounts of 10%, 20%, and 30% apply at 10, 50, and 100 credits. Annual subscriptions (billed upfront, with all credits delivered immediately) bundle credits at a discount: Audit-Ready (12 Audit-Ready credits, 10% off), Threat-Hunt (12 Threat-Hunt credits, 15% off), and Pro (8 Threat-Hunt plus 4 Adversarial-Depth credits, 20% off).

## Choosing the Right Tier

Start with Audit-Ready for your primary application. If the results reveal complex findings that warrant deeper investigation, upgrade to Threat-Hunt or Adversarial-Depth for the next run. Use Recon for quick post-deployment checks and low-risk applications. Reserve Adversarial-Depth for your most critical assets or pre-audit preparation.

Many organizations use a mixed approach: weekly Audit-Ready pentests for ongoing coverage, monthly Threat-Hunt pentests for thorough analysis, and quarterly Adversarial-Depth pentests as the comprehensive security baseline. This strategy balances cost, coverage, and depth across the year.

The tier does not affect Phase 1 tool execution - all 11 (black-box) or 14 (white-box) tools run at every tier. The difference is entirely in Phase 2: how many agents are deployed, how long they work, and whether specialized agents like the Exploit Chain Agent and Verification Agent are included.