Quick Summary
- What it is: Observ is an authorized pentest of one host or one AI agent, run by Cipher Projects.
- Price: $3,995 per host (web app or API). $5,995 per AI agent. A second host is a second test.
- You receive: a report, a signed attestation letter, a debrief, and one retest of fixed findings inside 90 days.
- Timing: testing starts within 10 business days of a signed scope. The report follows within 5 business days of testing.
Shipping got faster. The bill for a manual pentest did not. A customer security review still asks for a report, a letter, and a named scope. Most firms price that package as a multi-week engagement, then spend the first week on recon a person could have scripted. Observ is built for the team that needs that package on one host, with a person still signing off every finding.
Where this sits
Fair Developers builds and staffs engineering teams. Observ is the pentesting service of Cipher Projects, founded in Canberra in 2023. We send clients there when the job is an authorized test, and we keep the build work here. Figures below are the published prices on observ.si as of October 2026. Confirm them on the site before you book.
Why a Pentest Quote Still Starts in Five Figures
A traditional web-app pentest is priced for calendar time. Scoping calls, recon, manual checking, report writing, and a retest each sit on a day rate. AI made two of those steps cheaper to run and made the third more urgent: new code, and new agent tools, reach production before a quarterly test window.
The paperwork did not get optional. Procurement, an enterprise customer, or your own board still wants:
- A written scope and rules of engagement.
- Findings ranked so an engineer can patch them.
- A letter that says what was tested, when, and what the result was.
- A retest so “we fixed it” is a closed item, recorded as closed or still open.
Observ keeps that set and compresses the recon and checking that a manual firm bills as days. A person on the team reviews every finding before the report reaches you. The published promise is a start within 10 business days of a signed scope, and a report within 5 business days of testing.
What Observ Sells
One engagement is one target. For a host, that is one hostname and one port you name, such as a web app or an API. For an agent, that is one AI agent or LLM app. The same four deliverables come with either:
- Scope. Host, dates, and rules of engagement, plus an NDA.
- Test. OWASP testing guidance, and nothing outside the signed scope.
- Report. An executive summary for leadership and technical findings for engineers. A person has confirmed every finding in it.
- Debrief and retest. A call that walks through each finding and its fix, then one retest inside 90 days of what you have fixed.
The form on observ.si asks for a conversation. It does not reserve a window and it does not start a test. A deposit, when you take one, reserves the window. The site itself does not take payment. Amount and refund terms live in the engagement they send you.
Host Pentest and AI Agent Pentest
| Test | Target | Published price | What it looks for |
|---|---|---|---|
| Host pentest | One hostname and port: a web app or an API | $3,995 | An authorized test of that host, following OWASP testing guidance |
| AI agent pentest | One AI agent or LLM app | $5,995 | Prompt injection, tool misuse, data exposure, unsafe actions, output handling, and spend or availability limits. The model provider stays out of scope. |
A second host is a second test, at the same price. The agent test exists because an LLM app fails in ways a classic web checklist misses. Observ works from the OWASP Top 10 for LLM Applications and tests through the agent's normal interface, signed in as a user you provide. That covers prompt injection, tool and permission misuse, data the agent should keep, unsafe actions, output handling, and requests that loop or run up model spend. The model provider, and any third-party system you do not control, stay out of scope. The report, letter, debrief, and retest are the same shape as the host test.
If you are still designing the API those agents call, our notes on API security and REST API design cover the build side. A pentest checks the running host. It does not replace that design work.
The Paperwork You Can Hand an Auditor
The point of the package is that a customer’s security team already knows the format.
- Executive summary for leadership.
- Technical findings for engineers, ranked by CVSS score.
- Evidence and a fix for every finding, written so your team can reproduce the issue and patch it.
- A signed attestation letter stating what was tested, when, and the results.
Hand the letter to your auditor or to a customer’s security review. Treat it as evidence of this test. SOC 2 and ISO 27001 certificates come from accredited auditors. Observ publishes that limit on the site, and it matters: a pentest letter and a certification answer different questions.
The retest is included once. Ask inside 90 days of the report. It checks the fixes from this report and marks each finding closed or still open. A second full pass of the host is a new test.
What a Finding Looks Like
Every finding in the report has the same fields, so an engineer can act without a follow-up email:
- Where it lives, down to host and port.
- Severity as a CVSS 3.1 score, with the vector string.
- Evidence your team can reproduce. The sample on the Observ site is an administrative path that answers without a login. That sample is an example of the shape. It is a result from your host only if your report says so.
- What to patch, in plain language.
- Reviewed by a person on the team before the report ships.
The retest line on that finding is specific: inside 90 days they check the path you fixed. They record it closed or still open.
The Work They Turn Down
The gate is written authorization. If they cannot see it, they do not start. Observ lists four cases they refuse:
- A host with no written authorization.
- A third party you do not control.
- A request for exploit code or a weaponized payload.
- A production host you will not schedule a window for.
What they need before a test is short: hostname and port, an authorization contact and signature, a window, and either a staging host or a signed acceptance of production risk. Production is in scope when you schedule that window or sign that acceptance.
Findings include evidence and the fix. Requests for exploit code are turned down. That is the right shape for a report you can share with a customer. A weaponized write-up is a liability, and it is the wrong artifact for an engineer who needs to patch.
Who Runs the Test
Observ is the pentesting service of Cipher Projects. The published team is small and named, which is what you want on a letter:
- Keith Vaughan. Cloud engineer and AI security consultant, 18 years in IT. Contractor inside the Department of Defence on SAP deployment, and engineer at cybersecurity startups.
- Vinh Van Cong. AI security researcher and startup founder. National Representative on the Steering Committee of the CryptoCurrency Security Standard (CCSS) at the CryptoCurrency Certification Consortium (C4), where he works on AI-era threats to exchanges, custody, and payments.
Between them the background is government IT, cloud security, security startups, and security standards. The human review on each finding is the part that keeps an AI-assisted test from shipping a false positive into your board pack.
When to Book One
Book a host test when a customer, an auditor, or your own release process needs a dated report on one web app or API, and you can name the host, the port, and a window. Book the agent test when that product can call tools or return data a user should never see, and you want prompt injection and tool misuse in the same paperwork.
Wait if you cannot sign authorization, if the host belongs to someone else, or if production cannot take a scheduled window. Those are the cases Observ already declines.
Start at observ.si, or email hello@observ.si. If the gap is an engineering team to ship the fixes afterward, that part is Fair Developers.
Book the Test on Observ
Host pentest at $3,995. AI agent pentest at $5,995. Report, attestation letter, debrief, and one retest inside 90 days. The form starts a conversation. The signed scope starts the test.
Go to Observ