In the previous post, we argued that penetration testing is failing on price, compliance, and scale.
Underneath all three is another problem: buyers have little evidence of what happened between kickoff and the final report. Pentest is now a market broken in two ways.
Two Problems, One Root Cause
The first is misaligned incentives. Man-day pricing pays a vendor the same whether they surface one vulnerability or none. Checkbox buying rewards a report that clears an audit rather than one that reduces risk. You buy effort and call it assurance.
The second is the black box. Vendors routinely ask for white-box access with full visibility into your code and infrastructure, and yet their own methodology stays sealed to you. A conventional report tells the client what was found, but rarely what was tested, what was skipped, or how far each attack path was pursued. The report shows findings, not evidence of coverage.
No one in this market is paid to prove their work. Here is how we solve both.
Pay For Outcome, Not Mandays
If our test produces no finding rated Medium, High, or Critical, you get a full refund. First in Malaysia.
Billed by the day, a vendor earns the same whether they find serious problems or none; the buyer carries the risk of a shallow test. We intend to reverse that. A clean result costs us the whole engagement fee, so we dig as hard as we can before we call your system secure.
Every finding needs reproducible evidence and a rating under the agreed framework, which clients can inspect and challenge. The incentive is to find the material risk, not manufacture volume. No guarantee can prove that a system contains no vulnerabilities at all. Ours just does something more practical: we move part of the risk of an unproductive assessment from the buyer to ourselves.
Which raises the next question: How hard did your vendor actually look?
You See Everything We Tested
A typical report shows only valid findings. It doesn't tell you how many tests were attempted or whether testing stopped early. Thoroughness is taken on faith. A clean report could mean strong security OR limited testing. But buyers shouldn't have to guess.
So you asked for the full list of test cases. Traditionally, that means two to three times more man-days, because documenting every test manually is costly.
For us, as an AI-native company, this is already built into the product. We disclose every test case and attack vector, including every route we tried, whether it succeeded or failed. Your stakeholders can inspect the work itself, with proof of value and a complete audit trail.
Your internal teams know your systems better than any vendor. If we missed something, flag it. We'll test it, add the result, and close the gap without expanding the agreed scope.
AI makes this possible: faster, cheaper, and at a scale human-only teams can't match.
Same Scope, Same Price
Most pentest quotes are based on man-days, URLs, screens, or user roles. These are poor proxies for assurance: man-days reward slower delivery, page counts penalize complexity. They help vendors plan resources, but don't define the coverage you receive. The same scope can produce different quotes based on assumptions about staffing, speed, and depth.
We price by scope. The client-side attack surface is narrow and well suited to automated analysis, so it carries a flat per-platform price. Server-side calls are scoped individually using consistent definitions and pricing rules. Scope and price are agreed upfront.
Same scope, same price. Procurement gets a predictable number, regardless of who staffs the engagement.
That also protects our coverage promise: underpricing creates pressure to cut corners. We price for full coverage and deliver it.
The Old Model vs 4rthur
| Dimension | Traditional Manday Pentest | 4rthur |
|---|---|---|
| What you pay for | Manday | Outcome |
| Proof of coverage | None | Every test case and attack vector |
| If nothing is found | You still pay in full | Full refund if no Medium, High, or Critical finding discovered |
| Scoping basis | Manday estimates, plus per-URL and per-screen charges | Your actual scope. Client-side flat; only server-side scoped |
| Price consistency | Same scope, wildly different quotes | Same scope, same price, every time |
Three Questions to Ask Any Pentest Vendor
- How do you prove what you tested?
- What happens if you miss something?
- Where does your man-day discount come from?
No vendor priced by man-days can answer them well; the model structurally won't allow it. That gap is what we built our model to close.
Never Trust, Always Verify
If you are procuring a penetration test in Malaysia, send the same scope to every shortlisted vendor.
Compare more than the headline fee — ask them the three questions.
Apply the same scrutiny to 4rthur. Send us the identical scope, ask us the same three questions, and compare our coverage, terms, and price side by side.
It is time to apply zero trust to pentesting. Never trust, always verify your pentest vendor.