Growth
Mira · Research Bogan · Buy-side Atlas · Sell-side Dealio · Post-LOI Gillis · Hotel sales
Operations
Jericho · Support Chloe · Smart Cities Fleet · Freight AskTodd · Legal Demi · HR
Care
AskEllyn · Breast cancer Dawn · Recovery Ayla · Disabilities AskAshleigh · Caregiving Clinic · In-clinic
Platform
The Factory
Services
Security Assessments
Financial Services · Live Healthcare · Live Public Sector · Live Legal · Live Logistics · Live Hospitality and Entertainment · Live Business Services · Live
Ways to partner
Resellers and VARs Agencies and consultancies
Our partnerships
HPE Unleash AI TD SYNNEX Become a partner →
About Vision Case studies Insights FAQs
Get Started Ask Gambit
Security assessments

Authorized testing, run like a hire.

A named owner. An independent verifier. A fixed fee.

Authorized testing run like a hire: a captain staffs specialist workers, an independent verifier has to reproduce every finding, and only Attested claims reach your report — under a written scope, at a fixed fee. Workers propose, verifiers dispose, and a person stands behind what ships.

Book a scoping call → See the offerings →
Rules of engagement Signed before any traffic
In scopeNamed hosts, IP ranges, and applications. If it is not on the list, it is not touched.
WindowAgreed dates and hours. Active checks are rate-limited so your monitoring stays readable.
TechniquesPassive, active non-destructive, authenticated. Each one listed and agreed, never assumed.
Out of scopeDenial of service. Social engineering. Physical entry. Third-party tenants and shared platforms.
Emergency stopA named on-call on both sides and one channel that reaches a human at any hour.
How we work

Authorized work, or no work.

Security assessment is not a tool licence here. It is an engagement with a scope, a schedule, and someone accountable for what comes out the other end.

Scope before tooling

Every engagement opens with written rules of engagement: targets, dates, allowed techniques, exclusions, emergency stop, and named contacts on both sides. Nothing runs until that is signed.

Evidence, not exploit kits

Impact is proven with logs, screenshots, and request IDs your engineers can follow in a test environment. We do not ship weaponized proof-of-concept packages, and we do not sell exploitation as a self-serve product.

Owned end to end

A worker does the sweep. A person owns the finding. Triage, severity, false-positive elimination, and the remediation conversation are all inside the engagement, not billed as extras.

How the assessment floor is staffed

A floor of specialists, not one chatty bot.

Your engagement is run by a captain who staffs a team of narrow specialists, each with one job and one lane. Nobody asks a single model to do everything and hope. The work is divided the way a real assessment team divides it — and every claim has to survive a separate reviewer before it reaches you.

Captain

Plans the engagement and holds the scope.

The captain session reads the signed rules of engagement, staffs the seats below, hands each one a task with the right dependencies, and watches the floor. Specialists message each other; the captain keeps the whole run inside the agreed scope.

Recon

Maps the surface.

Subdomain and DNS enumeration, open ports and services, certificate transparency, and a technology fingerprint per host — an inventory of what is actually reachable in scope.

Web app

Tests the application.

Endpoint and bundle discovery, authentication and session flows, access control across roles and objects, and injection classes — each written up as a reproducible finding, not a claim.

API & cloud config

Checks the interfaces and settings.

REST and WebSocket APIs, JWT and OAuth handling, object-level authorization, and cloud configuration review — the places where a small misconfiguration quietly becomes a large exposure.

Infra & lab

Runs the hardened lab.

Every engagement runs from a pinned, hardened lab container with scoped tooling and an allowlist enforced at run time. Traffic that would leave the named scope does not get to run in the first place.

Report

Triages, scores, and kills false positives.

Findings are triaged, severity-scored, and checked against their evidence. Anything that cannot be reproduced against live state is rejected before it ever reaches the report. This is the seat that protects your inbox from noise.

Deeper validation

Only when a theoretical finding is not enough.

For the systems where impact has to be demonstrated, a validation seat goes further under direct human supervision. It is never self-serve.

Gated — signed scope, human on-call
The control plane

Workers propose. Verifiers dispose. Humans attest High and Critical.

The specialist who finds something does not get to publish it. Every finding is a typed claim that has to earn its way up a fixed path, and the only step that reaches your report is the last one.

Stage 1

Hypothesis

A worker proposes a finding with its preconditions and the effect it expects to see.

→
Stage 2

Reproduced

An independent verifier replays the captured evidence in a fresh context and watches it happen again.

→
Stage 3 · delivered

Attested

Reproduced, severity-scored, and — for High and Critical — signed off by a human. Only Attested findings ship.

Independent verification

The verifier works in a separate context and replays the evidence itself. The worker’s write-up is not enough — the finding has to recompute against the live target, or it does not count.

Scope gate before any tooling

The allowlist and rules of engagement are enforced at run time, ahead of the tools. Anything aimed outside your named scope is refused, not logged after the fact.

On our own harness

Run on the Gambit Factory harness.

Gambit runs this on the same agent-team harness we build everything else on: a captain session staffs the specialists, tasks carry dependencies, workers message each other, and the whole floor is visible while it works. It is the same way our teams ship software, pointed at a security assessment.

Where it runs

Against your scope, from a lab.

Assessments run against your named scope from a hardened lab container. Public benchmarks are how we qualify the floor internally — they are not what you are buying, and they are not your systems.

The offerings

Three ways to start.

Pick the depth that matches the decision you need to make. Each one is a fixed scope and a fixed fee, with a date it ends and a report at the end of it. Prices are listed in USD; CAD is approximate.

Surface Map
About 2 weeks
Recon and inventory
USD 4,800≈ CAD 6,500

An authoritative inventory of what you actually have facing the internet, and which parts of it deserve attention first. Most teams find something they had forgotten about.

Scope capUp to 25 hostnames or IPs, or one primary domain plus its discovered subdomains. Overage +USD 150/host or a custom quote.
Includes
  • Subdomain and DNS map
  • Technology fingerprint per host
  • Open ports and services table
  • Prioritized watchlist, ranked by exposure
  • Short executive note

Not included: exploitation, credential stuffing, social engineering, or authenticated app testing. Point-in-time map, no retest; optional refresh at 50% within 90 days.

App & API Assessment
About 3–4 weeks
Web and API findings Hero SKU
USD 14,500≈ CAD 19,500

One named web app and its first-party APIs, reviewed in depth, with every finding written so one of your engineers can reproduce it, fix it, and verify the fix. Only Attested findings ship.

Scope capOne application, up to 2 auth roles, up to 150 in-scope routes or endpoints. Extra app or role is a custom add-on.
Includes
  • Authentication and session flows
  • Access-control review across roles and objects
  • Injection classes reported as findings
  • Configuration and security header gaps
  • One retest window — up to 5 findings, within 30 days

Proof of impact: logs, screenshots, and request IDs — not public exploit kits.

Not included: red team, phishing, physical, or third-party tenant abuse.

Supervised Full Assessment
Scoped
Human oversight, explicit ROE
From USD 28,000≈ CAD 38,000

Deeper validation under a human on-call and a signed ROE, for the systems where a theoretical finding is not enough to move a decision. Same attestation standard.

Scope capScoped per engagement. The “from” price is the floor for one mid-complexity product surface; fixed after the scoping call.
Includes
  • Everything in App & API for the agreed surfaces
  • Supervised deeper-validation seats as needed
  • Your on-call available throughout the window
  • Coverage statement: what was and was not tested

Gate: never self-serve. Kickoff only after a signed scope naming every target.

Compared to what

Where this sits.

Three different things get sold as “a pentest.” They are not the same purchase. Here is the honest placement.

Vulnerability scanners

Cheap, automated, unverified

  • Signature and version matching at speed
  • Output is a candidate list, not findings — triage lands on your team
  • No access-control or business-logic reasoning
  • Good for continuous hygiene, weak for a decision
Day-rate boutiques

Skilled humans, open-ended meter

  • Typically priced by the day, so the total moves with the calendar
  • Scope tends to widen mid-engagement
  • Real expertise, but usually a queue before anyone starts
  • Quality tracks whichever tester you happen to get
Gambit assessment floor

Verified findings at a fixed fee

  • A captain staffs named specialist seats, not one general-purpose bot
  • An independent verifier has to reproduce every finding before it can ship
  • Only Attested claims reach the report; High and Critical are human-attested
  • Fixed fee with a hard scope cap and an end date, written before any traffic

No competitor logos and no invented scores. This is a description of three purchase models, not a claim about any specific vendor.

How it runs

Five steps, and you know where you are in all of them.

The same shape as every Gambit deployment: understand the job, write it down, put workers on it, report like a hire, then check the fix held.

01 · Discover

Understand the estate

We read what you already know. Architecture, previous reports, the systems that keep you up, and who owns each one.

02 · Build

Scope and ROE in writing

Targets, window, allowed techniques, exclusions, emergency stop, and named contacts on both sides. Signed before anything runs.

03 · Deploy

Workers run the agreed checks

Rate-limited, inside the window, against the named targets only. Evidence lands in a workspace scoped to your engagement ID.

04 · Report

Triaged, rated, de-duplicated

False positives removed before you see them. An executive summary for the business, and a detail section written for engineers.

05 · Retest

Confirm the fix held

Optional. After you ship, we re-run the same checks against the same scope and mark each finding closed or still open.

Evidence redacted before sharing · Scope allowlist enforced at run time · Nothing outside the named scope
Deliverables

What actually lands in your inbox.

A report you can hand to a board and a report you can hand to an engineer, in the same document.

01

Executive summary

What was in scope, what we found, and what it means for the business. One page, no jargon, written for people who will not read the appendix.

02

Findings with severity and evidence

Each finding rated, with the evidence attached and the reproduction written descriptively for your engineers. Duplicates merged, false positives already removed.

03

Remediation guidance

The fix, the order to do it in, and what to verify afterwards. Where a fix is architectural, we say so rather than pretending it is a one-line patch.

04

Retest window

Optional. A second pass against the same scope once you have shipped, with every finding marked closed or still open, and the delta written up.

Gambit · Findings viewIllustrative
14
Findings reported
2
High severity
31
False positives removed
9
Closed at retest
FindingSurfaceSeverityEvidenceStatus
Object-level access control gapOrders APIHighRequest IDsClosed
Session not invalidated on password changeAuth serviceHighSession logReported
Verbose error exposes stack tracesWeb appMediumScreenshotsClosed
Missing transport and content headersEdge configLowHeader dumpReported
Illustrative view of a report in progress. Not a customer engagement.
Boundaries

What we will not do.

Worth saying plainly, because the answer is the same whoever is asking and however the work is priced.

  • No unauthorized testing

    Written authorization is on file before anything runs. No exceptions, and no quick look at a system nobody signed for.

  • No denial of service, social engineering, or physical entry

    These stay out of scope unless a client contracts for them separately and in writing, with the extra controls that implies.

  • No third-party tenants

    Shared platforms and other people's data are off limits, even where they are technically reachable from a system you own.

  • No self-serve exploitation

    We do not sell exploit tooling, attack-path automation, or proof-of-concept kits. Validation happens under supervision inside a signed scope, or it does not happen.

Book a scoping call

Tell us what you want assessed.

Send the surfaces you care about and who is authorized to approve the work. We come back with a scope, a window, and a fixed price — usually within one business day. The Factory floor is already staffed, so work starts once the scope is signed rather than after a queue.

Prefer email? Write to AI@gambitco.io. Not sure which tier fits? Start a general conversation and we will point you at the right one.

1

A scoping call

Thirty minutes to agree what is in, what is out, and who signs. No tooling talk yet. You get the scope and the fixed price back, usually within one business day.

2

Rules of engagement

We write the scope cap, the window, the allowed techniques, and the emergency stop. You sign it before anything runs. Terms are 50% to start and 50% on report delivery.

3

The engagement

The floor runs the agreed checks, the verifier reproduces what they claim, and only Attested findings reach the report. Status channel throughout.

Engagement enquiry — priced in one business day

Your details stay between us and are used only to scope the engagement. Please do not send credentials or sensitive findings through this form.