// pricing
One engagement, full capability
Built for enterprise customers, quoted by asset scope and testing depth. No tiers — all 20 capabilities, every engagement.
If we find no verifiable vulnerability, you pay nothing. We put our money where our results are.
ENTERPRISE SERVICE
Enterprise Penetration Testing
Delivered per engagement: from asset perimeter mapping to exploit verification and retest — executed jointly by security experts and the AI squad. The AI scales the attack paths; experts correct course and execute advanced attacks. Quoted after scoping; we reply within one business day.
- All 20 capabilities — no tiers, nothing held back
- Multiple targets · full subdomain mapping and attack-surface charting
- Internal networks · lateral movement · cloud auditing (per scope)
- Smart contract audit (optional)
- One retest to verify remediation
- HTML / Markdown report with the full approval audit trail
- ATT&CK / WSTG / Kill Chain coverage matrix
- SARIF 2.1 export for GitHub / GitLab
- Expert + AI cross-review — zero guesswork
- Dedicated channel and SLA · delivered in 5–10 business days
Every engagement starts with a signed penetration testing authorization agreement.
Questions, answered
What do I need before a pentest?
You must own the target assets or hold written authorization from the owner. We sign a penetration testing authorization agreement with every client, defining scope, time windows and emergency contacts before testing begins.
Will testing affect my production systems?
All attacks run in isolated sandbox containers under rate control. Exploit verification follows the No PoC, No Finding principle: we stop the moment we have proof, minimizing impact.
What do I receive?
An HTML/Markdown report (with the approval audit trail), an ATT&CK / WSTG / Kill Chain coverage matrix, a SARIF 2.1 export and remediation advice — plus one retest.
How long does an engagement take?
Timelines are scoped per engagement, typically 5–10 business days. Rush jobs are negotiable.
What information do I need to provide?
The testing scope (domains / IPs / CIDR), business context, credentials if authenticated testing is needed, and an emergency contact.
How is my data protected?
Credentials, screenshots and evidence are encrypted at rest and used solely for the report. After delivery we sanitize or destroy data per agreement, and we can sign an NDA.
How is this different from running a scanner?
Scanners execute rules. The Gabala squad plans, decides, chains exploits and verifies every finding — with human experts supervising, correcting course and stepping in for advanced attacks. The report contains zero unverified “possible issues”.
What's the edge over a security firm or another pentest team?
Three things. Delivery model: firms sell man-days, Gabala charges by results — no verifiable finding, no fee. Firepower: one order fields a full squad of six AI attack roles plus a senior expert, running around the clock — coverage and depth a lone tester can't match. Quality: No PoC, No Finding — every finding ships with a proof of exploit, reproduction steps and expert review, ready to feed straight into remediation.
What role do human experts play?
The AI squad handles the heavy, scaled execution: recon, scanning and exploit verification run around the clock. Security experts stay in the loop the whole time — supervising every AI decision, correcting misjudgments, and personally designing and executing advanced attacks when the AI hits its limit (complex WAF bypasses, logic-flaw exploitation, and the like). Every final finding is confirmed by an expert.
How do I pay?
We test first and charge by results: if we find no verifiable vulnerability, you pay nothing. Offline payment is supported: bank transfer, Alipay or WeChat. After you submit an order, our team contacts you to finalize the agreement and payment.
Hand your next pentest to experts + the AI squad
No findings, no fee · from order to report in as little as 1 business day.