Deep or Standard? Match the test to where your security program actually is.

The short version: Standard is breadth — a broad coverage pass across your attack surface, right for every release. Deep is depth — a multi-round investigation that reasons about your identities and your business rules. Neither is "better." They answer different questions, and the one you need is decided by your maturity stage, not by which number is bigger. If you only remember one thing: breadth catches the classes that look the same on every site; depth catches the ones that depend on what your product promises.

The decision in one picture

Three stages, three answers. The mistake is buying depth before you have anything worth testing deeply, or buying breadth when an auditor is asking for a dated, full assessment. Find your rung first, then read the plan off it.

What each test actually covers

Before matching a stage to a plan, be precise about the two products, because the names are vaguer than the scopes. Standard (€990 / month) buys four scans a month: reconnaissance, crawl, and the core vulnerability classes, every result shipped as a verified finding with evidence and delivered to Slack, a webhook, GitHub or email. It is the pass you run on every release to catch the common classes early. Deep (€2,900 / month) is everything in Standard and then the rounds a scanner-shaped pass structurally cannot reach: identity replay and cross-tenant BOLA, business-logic invariants, and the AI-agent surface — prompt injection and MCP — with your trust page kept current between runs.

The dividing line is identity and intent. Standard tests the surface that looks the same for everyone. Deep tests the surface that only means something once it knows which account acted and what rule that account was supposed to obey. That is why Deep needs the test identities you supply and Standard largely does not — and it is why the expensive bugs (broken access control, cross-tenant data access, logic you can abuse for free) show up in Deep.

Stage 1 · Your first-ever pentest

You have shipped a product, maybe closed a few deals, and you have never had anyone test it adversarially. The temptation is to subscribe to a monthly plan and feel covered. Resist it. What you need first is a baseline — one honest, full assessment that tells you where you actually stand, including the business-logic and access-control classes a release scan skips. That is the one-off Deep test (€3,500, one-time): a full Deep assessment with the fix retest included, and it carries no finding, no fee — if it proves nothing, you pay nothing, which is the right risk to put on us rather than on a first-time buyer. Start here, read the coverage map and the known gaps, fix what it finds, let the included retest confirm the fix closed, and then decide whether your release cadence justifies a subscription.

Stage 2 · Meeting an annual compliance requirement

SOC 2, ISO 27001, a customer's security questionnaire, a procurement gate — something now asks for a penetration test on a schedule, and you need an artefact an auditor will accept. This is exactly what the one-off Deep test is positioned for: a full Deep assessment with a published coverage map, per-finding severity, reproduction and retest status, and the included fix retest that shows an issue was actually closed rather than merely reported. One a year satisfies the requirement and gives you a dated scope-and-rules snapshot to hand the auditor.

If the requirement is really "demonstrate we test continuously," or you ship often enough that a once-a-year snapshot goes stale, Deep monthly (€2,900 / month) covers the same depth on a recurring cadence and keeps a trust page current between runs — a shareable, verifiable page that shows when you were last tested, that findings were independently verified, and that fixes were retested. Either way, the deciding factor is cadence: a point-in-time obligation points to the one-off; a "stay current" obligation points to Deep monthly.

Stage 3 · Running a continuous program

You ship weekly or daily, you have real tenants and roles, and a security issue that lands in production is expensive. Here the two plans stop being alternatives and start being layers. Run Standard on every release as the fast, broad regression pass — four scans a month, piped into the channel where your engineers already work, so a new common-class bug is caught before it ages. Run Deep monthly for the slow, deep work on identities, business logic and your AI-agent surface, which changes less often per deploy but costs the most when it breaks. The combination is the continuous program: breadth on every change, depth on a steady beat, with the trust page kept current so customers and auditors see a live posture rather than a snapshot. We go deeper on this model in continuous penetration testing.

Where Stress fits

Stress (+€900 / month) is an add-on to any plan, and it is deliberately not part of either default. It is authorized, bounded resilience testing — finding the rate limit before a real attacker does, with narrow rails and circuit-breaker stop thresholds. It is never a denial-of-service, it requires separate written consent, and it stops on your signal or ours. Add it only when you have a specific resilience question and an environment you are willing to push on — not as a reflex because it is available. For most teams at Stages 1 and 2 it is premature; it earns its place once you are running a continuous program and want to know how the surface behaves under pressure.

A short decision rule

If you have never been tested, buy a one-off Deep and get a baseline. If an auditor or customer wants a yearly test, buy a one-off Deep; if they want proof you test continuously, buy Deep monthly. If you ship constantly and have identities and logic worth defending, run Standard per release and Deep monthly together. In all three, remember what the subscription buys that a tool does not: every result is a verified finding with evidence, and anything that cannot be reproduced is held back rather than counted — the honest-coverage line that makes the number on the cover mean something. More on why that matters in autonomous pentesting.

FAQ

Is a Standard scan enough to satisfy a SOC 2 or ISO 27001 pentest requirement?

Not on its own. Standard is a broad coverage pass — recon, crawl and the core classes — right for every release. An annual pentest requirement is what the one-off Deep test is built for: a full Deep assessment with the fix retest included and a published coverage map, positioned to meet a yearly requirement. If you already run Deep monthly, that obligation is covered continuously.

What does Deep test that Standard does not?

Deep is everything in Standard plus the layers that depend on your identities and rules: identity replay and cross-tenant BOLA, business-logic invariants, and the AI-agent surface — prompt injection and MCP. Standard reaches recon, crawl and the core classes; Deep is the multi-round investigation that reasons about your business and the accounts you supply.

Can I start on Standard and move to Deep later?

Yes, and most teams should layer rather than switch, because Deep is defined as everything in Standard plus the deeper rounds. A common path is a one-off Deep for a baseline, Standard per release for regressions, then Deep monthly once you have identities and business logic worth testing continuously. Annual billing includes two months free, and your exact scope is quoted in writing first.

Still deciding? See the plans side by side on pricing, read how the depth works in autonomous pentesting and continuous penetration testing, or book a demo and we will scope the right one in writing before anything runs.