Skip to content
Cognivators
All engagementsTaking clients
03 / Audit & procurement

The auditor set the date. The pentest still has to be real.

A five-day manual pentest of your web app, API, or perimeter, delivered with the report and the signed attestation letter your auditor, customer, or insurer actually asks for.

Start the pentestAsk a question first

Fixed scope · 5 business days· scoped in writing first

What it costs to leave it

  1. The date does not move

    Weeks in a large firm's queue is the deal slipping a quarter.

  2. A scanner PDF gets sent back

    Reviewers know an export from a test. No methodology, no signature, the clock restarts.

  3. Findings with no fix path

    A 40-page list becomes a remediation plan you write yourself, on the same deadline.

How it gets closed

Exactly what
gets reviewed.

A written scope, a manual test against it, and the two documents that end the conversation with your auditor.

THIS ENGAGEMENTRules of Engagementscope locked, signedManual testdays 1 to 4, auth and unauthWritten reportseverity, repro, fixAttestation lettersigned, dated, scopedAuditor, customeror insurer: acceptedWHAT USUALLY GETS SENTScanner exportno scope, no methodologyNO SIGNATURE, NO DATESent backthe clock restarts
  1. 01

    Scope

    Web app, API, or perimeter, locked in a signed Rules of Engagement.

  2. 02

    Written report

    Severity, reproduction steps, and a fix an engineer can act on.

  3. 03

    Attestation letter

    Signed: what was tested, on what scope, when. Matched to your auditor's template.

  4. 04

    Fix PRs

    Where the fix is small and clear, a pull request, not a paragraph.

Timeline

A fixed calendar.
No open-ended scope.

Standard turnaround · 5 business days

  1. Day 0

    Kickoff

    Scope, Rules of Engagement, testing window, staging access.

  2. Day 1 to 4

    Manual testing

    Authenticated and unauthenticated, a proof of concept behind every finding.

  3. Day 5

    Report, letter, call

    Full report and attestation letter, then a walkthrough.

  4. Within 60 days

    Free retest

    So the report your auditor sees reflects what is fixed.

Public record

Same class of bug,
found in public.

Every row links to the vendor's own repository or advisory and names the author.

  1. Google

    CVE-2026-14540

    Server-side request forgery in the generic HTTP source and tool components of MCP Toolbox.

    Reported. Fixed by Google, credited by name.

    Fixed Jun 2026

  2. GitHub

    github-mcp-server #3056

    A redirect-following transport re-attached the GitHub token on every hop. Hardened so it's only attached to GitHub's own configured hosts.

    Patch authored here, merged upstream.

    Merged Aug 2026

  3. Weaviate

    PR #12961 · HackerOne

    Google module accepted an arbitrary apiEndpoint, a credential-exposure path.

    Confirmed. Fixed by Weaviate.

    Merged Sep 2026

  4. JPMorgan Chase

    jpmorgan-payments/ai #19

    One tool skipped the domain allowlist its sibling tool already enforced.

    Validated and fixed through JPMC Responsible Disclosure.

    Merged Sep 2026

  5. 1Password-MCP (community)

    GHSA-q3gg-rgxh-gh64

    op_run leaked the OP_SERVICE_ACCOUNT_TOKEN master credential to subprocesses and model context.

    Advisory published, credited by name.

    Source

What you get

Fixed scope.
Confirmed in writing.

Procurement-Ready Pentest

  • A written report: severity, reproduction steps, specific fix guidance
  • A signed attestation letter, the document an auditor or insurer asks for
  • Fix PRs where the fix is small, plus one free retest
Target
Web application, API, or infrastructure perimeter
Turnaround
5 business days
Deliverable
Severity-rated report, signed attestation letter, fix PRs where small
Retest
One, free, within 60 days
Access
Staging or test environment preferred

Priced after a short look at the system, confirmed in writing before anything is touched. Scope that grows is re-quoted first, never billed after.

Start the pentest

Before you email

Anything else: ask it first. No scope is confirmed until it is answered.

03 / Audit & procurement

Ready to find out what is actually there?

Start the pentestCompare all three

Fixed scope · 5 business days

Replies come from the person doing the work, within one business day.