AI agent security test
From $6,500
5 to 7 tester days
- Written scope and rules of engagement
- Certified lead tester named in your proposal
- Report your auditor can sample
- Fix pull requests
- Free retest within 90 days
- Signed attestation letter
Pricing - What a test costs.
Starting prices for one product or one agent. Your price is agreed in writing before we start and does not change unless the scope does.
Voice agent security test
From $8,500
7 to 8 tester days
- Written scope and rules of engagement
- Certified lead tester named in your proposal
- Report your auditor can sample
- Fix pull requests
- Free retest within 90 days
- Signed attestation letter
SaaS review with fix pull requests
From $6,500
4 to 6 tester days, or $4,500 with an AI or voice test
- Written scope and rules of engagement
- Certified lead tester named in your proposal
- Report your auditor can sample
- Fix pull requests
- Free retest within 90 days
- Signed attestation letter
Compared - Between a scanner and a large firm
Automated pentest tools
$1,500 to $4,000
Fast and cheap. Strong on the standard web list, weak on agent chains and business logic.
Wardkey
$6,500 to $12,000
A certified tester named in your proposal, fixes as pull requests, retest and a signed letter.
Large human-led firms
$10,000 to $16,000+
Deep, but quoted, slower to start and rarely write your fixes.
Terms - Payment, retest and cancellation
- Payment
- 50% when the scope is signed and 50% when the report is delivered, each due within 15 days. Work under $5,000, such as a retest after a change, is paid at signing.
- Rescheduling
- One free move of the start date with at least ten business days' notice. Later moves depend on tester availability.
- Cancellation
- Cancel ten or more business days before the start and we refund the first payment in full. Later than that, we keep 25% of the price for the tester time we reserved. Once testing starts, work done is billed.
- Retest
- One free retest of the fixed findings within 90 days of the report. Further retests from $1,500.
- The full terms are in our services terms.
Not included
- Fixes for findings outside the agreed scope
- Load and denial of service testing
- Physical and social engineering tests
- Legal opinions
Work we decline
- US-person only scope. FedRAMP, CMMC, ITAR, CJIS and IRS tax data environments require testers in the United States. We say no.
- Systems we fixed in PCI scope. PCI DSS requires organizational independence. We test it or we fix it, never both.
- Targets you do not own. We test only systems whose owner has signed a written authorization.
After the test - Follow-on work for the same team
What changes the price - Scope, not surprises
- Agents and tools. More agents, tools or MCP servers mean more chains to test.
- Tenant model. Complex roles, SSO and shared resources add test cases.
- Channels. Phone, chat, email and API channels are tested separately.
- Retests after a change. A new model, provider or major feature can be retested from $1,500.
FAQ - Questions buyers ask
Will my SOC 2 auditor accept your report?
Auditors look for scope tied to your systems, a named method, dated testing, findings with severity and evidence that fixes were retested. Our reports are written to that list.
Who writes the fixes, and how do you stay independent?
We open pull requests from a fork or a protected branch, your engineers review and merge them, and a tester who did not write the fix retests. The attestation letter says who wrote each fix.
Do you test production?
We start with staging or dedicated test tenants. Production is tested only with your written risk acceptance.
Where are you based?
Wardkey is a brand of Meridal Group LLC, a United States company. Testing is performed from the EU. We do not take work that requires US-person testers, such as FedRAMP, CJIS or ITAR scope.
How long does it take?
Most tests start within two weeks of the signed scope and take four to eight tester days. The report follows within three business days.
What if you find nothing?
Then the report says exactly what was tested and how, which is what your customer's reviewer needs to see.
Send us the questionnaire your customer sent.
We will tell you which lines a test answers, in writing, within one business day.
Who we are
- CompanyMeridal Group LLCWyoming, United States
- TestingPerformed from the EUFor clients in the US and Europe