What AI pentest tools cost

Two compliance platforms bundle a test. Vanta says customers on its Plus and Growth plans with up to 750 employees get one free XBOW pen test a year, with coverage limits (Vanta). Drata says new customers receive an Aikido agentic pentest “worth up to $4,000” under its current offer (Drata).

The open-source agents cost nothing to license, but each run calls an AI model you pay for. Two published data points give a sense of scale:

• Keygraph, which makes the open-source Shannon agent, reports one run against the Photoview photo app costing $6.10 in model fees with DeepSeek v4 Flash, $35.07 with Grok 4.6 and $115 with Claude Opus 5. The cheapest run found 3 of 7 vulnerabilities the project later patched; the Opus run found 6. It compares this with Aikido and XBOW tests at $4,000 each from a separate Doyensec study. This is a vendor’s own benchmark (Keygraph).
• Researchers who pitted AI agents against ten professional testers on a university network of about 8,000 hosts report that certain variants of their ARTEMIS agent cost $18 an hour, against $60 an hour for a professional, while noting higher false-positive rates (arXiv 2512.09882).

Model fees are only part of the cost. Someone still has to scope the test, get written authorisation, watch the run and check every finding before it goes in a report.