Skip to content
    BlueBasket Labs

    Penetration testing as a service

    A yearly pen test, a retest, and a report your customers will accept.

    We combine Shannon, an autonomous AI penetration testing tool, with hands-on human testing. You get broad coverage quickly, and every finding in your report has been verified by a person.

    Scope my pen testSee methodology

    What's included

    Yearly assessment + retest

    Annual assessment

    Web application, API and external attack surface testing against OWASP Top 10 / ASVS, including authenticated testing with your test accounts.

    Retest included

    Once you've fixed findings, we retest and issue an updated report and a retest summary you can share with customers.

    Clear reporting

    Executive summary for buyers, technical detail for engineers: risk ratings, evidence, reproduction steps and fix guidance.

    In scope

    • Web applications (authenticated and unauthenticated)
    • REST and GraphQL APIs
    • External network and cloud-exposed services
    • Authentication, authorisation and session handling
    • Business logic abuse and multi-tenant isolation

    Why AI-assisted + human

    Automation covers a lot of ground quickly and consistently. A human tester then validates results, removes false positives, and digs into business logic and chained attacks that tools miss.

    Optional add-ons: mobile apps, internal network, cloud configuration review.

    Pricing

    Pen Testing as a Service

    from A$12k per year

    ex GST/taxes

    • Two penetration tests per year
    • One web application and its API
    • Retest of findings included

    Larger scopes quoted separately.

    Get a quote

    Best value

    Security & Compliance bundle

    from A$20k per year

    ex GST/taxes

    • Everything in Compliance Readiness
    • Everything in Pen Testing as a Service
    • One team for testing and compliance evidence
    Get a quote

    Prices are starting prices in Australian dollars, excluding GST and other taxes. USD pricing available on request. Final price is confirmed after a short scoping call.

    Will testing affect production?

    We agree rules of engagement upfront. Where possible we test a staging environment that mirrors production; otherwise we use safe, rate-limited techniques and agreed testing windows.

    What do you need from us?

    Signed authorisation, test accounts for each role, API documentation if available, and a technical contact during testing.

    How quickly do we get the report?

    Timelines depend on scope and are confirmed in your proposal.

    Need a pen test report for a customer?

    Get in touch for a short call. We'll look at what your customers are asking for and recommend the smallest useful next step.

    Get in touchGet a free external scan