Why businesses choose Kaamel
The expert-led assessment was remarkably efficient and the report exceptionally thorough — and it gave our security team a concrete sense of what AI-driven security can do.
CSO at a leading logistics company
Trusted by over 200 leading global enterprises
Two ways to run a test
Both tiers are driven by the same AI security agent. What changes is how much senior expert judgment sits on top — and how deep we go.
AI Agent Assessment
Coverage you can put in front of an auditor.
- The agent runs the end-to-end assessment across every in-scope asset.
- A security analyst calibrates severity, clears false positives, and signs off on the report.
- Fast and repeatable — run it quarterly as a standing control.
Understanding the security posture of edge assets, or running periodic retests on assets that have already had a deep assessment — so you track how the security picture changes as your application evolves.
Expert-Guided Assessment
Depth. The findings that would actually hurt.
- A senior tester works alongside the agent for the whole engagement.
- Business-logic and authorization flaws that automation alone won't reach.
- Chained attack paths, written up as a full exploitation narrative.
A core product launch, a security-sensitive release, SOC 2 or ISO 27001 certification, or M&A due diligence.
How an engagement runs
Eight phases, same order every time. You see what we tested and what we didn't — no padded coverage numbers.
Scope & Authorization
We agree on targets, timing, and boundaries in writing before anything runs. Authorized assets only — no exceptions.
Pick any phase to read what happens in it.
What we test
Web Applications & APIs
Authentication and authorization, IDOR and broken access control, injection, SSRF — and the business-logic flaws that scanners structurally cannot find.
Mobile Apps
Android and iOS. Static analysis plus JS and Hermes bundle decompilation, which recovers the real cloud API surface the app talks to — not just the endpoints on your marketing site.
SaaS Platforms
Multi-tenant isolation, cross-tenant access, and credential and session handling — the failures that let one customer's account reach everyone's data.
SDKs & Components
Dependency and supply-chain exposure, with version-to-CVE mapping across the third-party code you ship.
Cloud & CI/CD
Object-storage exposure, GitHub and GitLab organization CI/CD attack surface, and dependency confusion.
Tested against the standards your auditor already recognizes
- MITRE ATT&CK v18.1
- OWASP WSTG v4.2
- OWASP Top 10:2021
- OWASP MASVS v2
Why the report is worth reading
Anyone can hand you a scanner export. The difference is what happens after a finding appears.
Proof of control, not scan output
We demonstrate real impact using benign markers or our own test accounts. What comes back is confirmed and reproducible.
Honest severity
Findings we can't verify are downgraded or excluded, and labeled as such. Nobody loses a week chasing noise.
A runnable PoC on every finding
Plus a CVSS v4.0 score from our own scoring engine, so severity stays consistent across engagements.
Written for the people who fix it
Multilingual reports in HTML, PDF, DOCX, or Markdown — with the end-to-end attack chain written out where one exists.
Verify, don't harm
These are hard limits, enforced in the platform itself — not a paragraph in a policy document.
- Authorized targets only
- No contact with real user or customer data
- No downtime, no denial of service
- Every action reversible
Penetration testing questions, answered
- Two tiers: the AI Agent Assessment is priced by asset type and count; the Expert-Guided Assessment is quoted per engagement.
- Every finding ships with a runnable proof of concept and a CVSS v4.0 score, and your fixes are retested.
- Tested against OWASP WSTG v4.2, OWASP Top 10:2021, OWASP MASVS v2 and MITRE ATT&CK v18.1.
- Coverage: web applications, APIs, Android and iOS apps, SaaS platforms, SDKs and components, cloud and CI/CD.
How does Kaamel charge for a penetration test?
Two tiers: the AI Agent Assessment is priced by the type and number of assets in scope, and the Expert-Guided Assessment is quoted to the scope and depth of your project. Both tiers include a report with a runnable PoC and a CVSS v4.0 score on every finding, plus a free retest of your fixes. You'll get a concrete price on a scoping call.
Does this satisfy the penetration test requirement for SOC 2 or ISO 27001?
Yes. The AI Agent Assessment is built for that requirement: every in-scope asset is tested against OWASP WSTG v4.2, OWASP Top 10:2021, OWASP MASVS v2 and MITRE ATT&CK v18.1, and a security analyst calibrates severity and signs off the report so an auditor can accept it. Many customers run it quarterly as a standing control.
What do you test?
Web applications and APIs, Android and iOS apps (including JS and Hermes bundle decompilation), multi-tenant SaaS platforms, SDKs and third-party components, and cloud and CI/CD environments such as object storage and GitHub or GitLab pipelines.
Will the test affect production or touch customer data?
No. Hard limits are enforced in the platform itself: authorized targets only, no contact with real user or customer data, no downtime or denial of service, and every action reversible. Findings are proven with benign markers or our own test accounts.
What is in the report?
Confirmed, reproducible findings only. Each carries a runnable proof of concept, a CVSS v4.0 score and a write-up aimed at the engineers who fix it; anything we cannot verify is downgraded or excluded and labeled as such. Reports ship in HTML, PDF, DOCX or Markdown, in the language your team works in.
How does an engagement start?
With scope, timing and boundaries agreed in writing. A 30-minute scoping call tells you which tier fits, what a test would cover and when you would have the report; nothing runs before authorization.
Related services
Last updated:
