Buyer's guide
A pentest firm bills $15,000–$50,000 for a two-week snapshot that's stale the day it's delivered. A small bounty engagement hunts your live product continuously for a fraction of that. Here's the honest comparison.
| Traditional pentest firm | Us (small-team bounty) | |
|---|---|---|
| Typical cost | $15k–$50k per engagement | $500–$1,500 flat, or $400/mo |
| Duration | 1–2 week snapshot | Continuous or per-sprint |
| Coverage over time | Stale after delivery | Your product changes, we keep hunting |
| AI agent coverage | Rarely offered | Core service — agent red-teaming from $4.5k |
| Finding style | Checklist + scanner + manual | Manual hunting, business-logic focus |
| Report | Formal, 100+ pages | Short, actionable, reproduced |
| Compliance checkbox | Yes (SOC 2, audits) | No — pair with a firm if you need the paperwork |
If an enterprise customer or auditor requires a letter from a certified firm, hire the firm — that's a paperwork requirement, not a security one. Then keep us on the side for the actual hunting, including the AI agents most firms don't test. The two aren't rivals; firms find breadth, hunters find depth.
Bug Bounty