← Blog
Pentesting

What an AI penetration test costs — and what it does not replace

A manual pentest is a large, infrequent purchase. Autonomous agents make it small and frequent. The honest comparison, including the parts humans still do better.

The MILLENNIUMS.AI team · 26 September 2026 · 8 min read

A traditional penetration test is a project. You scope it, wait for a slot, pay a five-figure invoice, and receive a PDF weeks later describing a system that has since changed. For a team shipping weekly, that is a snapshot of something already gone. Autonomous AI agents change the economics — and, if you are careful about it, the cadence.

Where the cost goes in a manual engagement

Most of a manual test's price is skilled hours spent on work that is repeatable: enumerating endpoints, trying the known classes of attack, writing up what was found. That is why typical engagements run from roughly ten to thirty thousand dollars, and why teams buy one or two a year.

What changes with agents

Our agents test AI applications — chatbots, agents and RAG endpoints — against the OWASP LLM Top 10, mapped to MITRE ATLAS. Each run follows the same shape: reconnaissance, attempts against each category, and a chain that walks from one weakness to the next until it either produces a working proof of concept or produces nothing.

  • Every reported finding has a reproducible proof of concept. Candidates the agent cannot prove are discarded and never reach your queue. That is the single biggest efficiency: engineers do not spend a morning disproving false positives.
  • Minutes to a proven finding, not weeks to a report. The run is narrated as it goes, so you can see what was tried and what came back.
  • A budget ceiling bounds the worst case. Each plan sets a cap on what a run may spend, so cost is predictable.
  • Three artifacts come out: a shareable attestation letter, a full technical report for your engineers and auditor, and a machine-readable twin for GRC tools.

The arithmetic

Our pricing is per engagement and steps down with volume: $399 for an independent practitioner, $299 for a firm, and from $249 for an MSSP. Here is a deliberately plain comparison for a team that ships monthly and wants an assessment each time:

Manual, 12 a yearAI agent, 12 a year
Price per assessment≈ $10,000–30,000$249–399
Annual spend≈ $120,000–360,000≈ $3,000–4,800
Time to resultsWeeks per engagementMinutes to a proven finding
Cadence in practiceOne or two a yearEvery release
This is not a like-for-like comparison, and we do not want you to read it as one. A manual engagement covers more ground — infrastructure, physical, social, bespoke business logic — than an automated run against an AI application. The point is not that $399 buys what $30,000 buys. It is that the repeatable part no longer has to be bought at manual prices.

Where humans still win

  • Novel business logic. An agent finds what fits patterns it knows. A person who understands your product finds the abuse case nobody catalogued.
  • Scope judgement. Deciding what is worth attacking, and what is out of bounds, is human work.
  • Assurance a regulator or customer will accept. Some contracts require a named, qualified tester. We offer a certified human review of a scan for that reason, and we do not describe an automated run as a certification.

The sensible pattern is layered: automated testing on every meaningful change, and a human engagement for depth, on a schedule and at a scope the automated layer has already cleaned up. The human's hours go to the hard part.

Efficiency you can check

Three things to ask any vendor, including us:

  1. What fraction of your findings come with a working proof? Ours is every finding reported; ask what happens to the rest.
  2. Can I replay it? A proof of concept you cannot re-run is a claim.
  3. What did you try and fail at? A clean result is only meaningful if you can see what was attempted.

Safety is part of the price

An offensive tool pointed at your systems needs boundaries. Public targets require verified ownership before any test, testing runs in a throwaway sandbox with bounded egress and budget, and source is never used to train a model. Those are on our Trust Center, and they are the reason an automated test is something you can run on a Tuesday afternoon.

Try a scan against a staging application from the pen testing page, see the plans, or talk to us about the firm and MSSP tiers.

Keep reading

More from the blog.

Agent Trust Fabric
Agent Trust Fabric: an identity, a record, and — soon — a checkpoint for every AI agent
What ATF gives an agent today, what the ATF Enforce preview adds, and — just as important — what we do not yet claim.
Agent security
The agent that was blocked, so it found another way: what the Services Australia incident teaches
An AI research agent hit an access block on an Australian government service and kept going until something worked. What actually failed, and how we designed around it.
Platform
Agentless and graph-first: why we start with a map, and where the time and money go
Installing agents everywhere and triaging flat lists of findings are the two biggest hidden costs in security tooling. Here is how an agentless graph removes them.