Fixed-Scope Assessments
A fixed scope, a fixed price, and a date on the calendar.
Three packaged assessments with a fixed scope and a fixed price, delivered in 48 hours to 2 weeks. Every finding is verified by a senior operator before it reaches you.
Built for organizations that need to know their exposure now. No scoping call and no proposal: pick a package, submit your target, and the report arrives on the agreed date.
Every finding manually validated by a senior operator.
How a fixed-scope assessment works.
Automated tools miss real attack paths. Custom engagements take weeks to scope and deliver. A fixed-scope assessment uses AI to accelerate reconnaissance and analysis, and a senior operator validates every finding by hand.
This is AI-assisted testing of your environment. Testing of your own AI systems, agents, model integrations and retrieval pipelines is a separate service: AI and LLM Application Testing.
-
AI does the reconnaissance.
Subdomain discovery, asset enumeration, technology fingerprinting, credential correlation, and attack path analysis run in hours instead of days.
-
Humans validate the findings.
Every vulnerability is reviewed and manually verified by a senior operator. Nothing reaches your report until a person has confirmed it.
-
Fixed price and a fixed timeline.
No hourly billing and no scope creep. You submit your target and receive the report on a date agreed in advance.
-
Built on offensive methodology.
The AI engine follows the same methodology our operators use on custom engagements, and runs it faster.
Three packages.
Each button carries the package into the request form, so there is nothing to scope.
-
RapidRecon
$2,500
- External attack surface assessment
- Asset discovery, exposure mapping, leaked credential detection
- AI-generated attack narrative
- PDF report
Best for First-time security assessment, pre-acquisition due diligence, board requests
-
Playbook
$5,000
- Full external penetration test
- Manual exploitation validation
- Prioritized remediation roadmap
- Executive and technical reports
Best for Annual security validation, pre-launch testing, post-incident verification
-
ReadyCheck
$7,500
- Application penetration test (web or API)
- Authentication and business logic testing
- Manually validated AI discovery
- OWASP Top 10 remediation guidance
Best for Pre-production app testing, SaaS vendor validation, third-party risk
Some engagements need a custom scope.
Fixed-scope assessments cover external and application exposure quickly. Internal networks, cloud and identity, red team objectives, and applications with complex business logic need a custom engagement with manual depth.
| Attribute | Fixed-scope assessments | Custom engagements |
|---|---|---|
| Scope | Fixed scope, fixed price | Scoped to your environment and objectives |
| Timeline | 48 hours to 2 weeks | 3 to 4 weeks, longer for red team operations |
| Price | Starting at $2,500 | Starting at $30,000 |
| Method | AI-accelerated with human validation | Senior operator, manual, full adversarial methodology |
| Best for | External and application exposure, answered quickly | Internal networks, cloud and identity, red team objectives, and applications with complex logic |
| Deliverable | PDF report | Executive and technical reports, debrief, remediation roadmap, retest |
Frequently Asked Questions
Is a fixed-scope assessment as good as a traditional pen test?
They solve different problems. A fixed-scope assessment identifies high-signal findings quickly, which suits operational security improvements and ongoing validation. A traditional pen test goes deeper into business logic, complex authentication, and custom attack chains, and produces the formal attestation required by most compliance frameworks. Many clients start with a fixed-scope assessment and engage us for traditional testing when they are ready for deeper work.
Does a fixed-scope assessment satisfy compliance requirements like PCI, HIPAA, or SOC 2?
No. Formal compliance frameworks require manual testing with full attestation. Our traditional penetration test service meets those requirements. Fixed-scope assessments are designed for operational risk reduction, not compliance attestation.
Who reviews the findings?
Every finding in every report is manually reviewed and validated by a senior Atarus operator before delivery. The AI accelerates the discovery and analysis. Humans confirm exploitability and business impact.
What if you find a critical vulnerability?
You will know within hours. Critical findings are escalated immediately, ahead of the final report. We also offer an accelerated path to full remediation validation if needed.
Can I get a sample report?
Yes. Email info@atarussecurity.com for a redacted sample.
Know your exposure before someone else finds it.
All fixed-scope assessments are covered under mutual NDA. Results are delivered privately.