Home / Solutions / Agencies
For security agencies
Three times the pentests, the same team.
You are capped by hours, not by clients. We do the cross-role and business-logic work with proof attached. Your pentester reviews and signs. Your name goes on the report.
The ceiling
Your ceiling is hours, not clients
You could sign more clients next quarter. What you cannot do is find another senior tester next quarter. So the firm grows at the speed of the bench, and every proposal turns into a calendar negotiation.
Most of those hours are not judgement. They are the grind: logging in as each role, trying each door, writing up what happened. That part repeats on every engagement, and it is the part we take. Your tester spends the day on the findings that need a human, then signs the report.
Where the hours go
The work we take off your bench
Every role against every door
Five roles against six resources is thirty doors, and thirty doors is a day by hand. The authorization matrix walks all of them and marks each cell allowed, denied or leaked, with the request that proved it.
Business-logic abuse
Stacked discounts, negative quantities, quota resets, payment races. The module lands 4 January. Until then it is the part of the engagement your tester still does by hand, and we are not pretending otherwise.
Exploited, not suspected
If we did not break it, we do not report it. Nothing arrives on your tester’s desk that they have to spend an afternoon disproving.
The write-up
Each finding carries the request, the response, the screenshot and the line of code. Most of the report is written by the time your tester opens it.
Proof the fix held
Rescanning is a new guess. Re-exploiting is proof. The retest replays the exploit that worked, and prove-the-fix lands 16 November.
The eleven months after
Your client gets exploit-proven findings between engagements instead of silence. That is a renewal conversation that writes itself.
The terms
Published, not hidden behind a call
30% off the price of the day. Most firms resell at list or fold it into an existing retainer, and keep the margin.
$489 is the founding partner rate and $839 is the rate at list. Founding partners lock 30% off today’s price for two years. All prices exclude 18% GST, which applies to customers invoiced in India. If you would rather introduce than resell, the referral route pays 15% of first-year value when the customer pays. The full partner terms →
Mandated work
It routes through you, not around you
Plenty of your clients are testing because a regulator told them to, and that work has to be signed by a firm that is empanelled to sign it. Cyberlop Labs is not that firm. We hold no empanelment and we are not applying to be the name on anyone’s mandated report.
The shape that works is the one you already have: you hold the empanelment, you review the evidence, you sign. We do the cross-role and business-logic testing underneath it. Your client never has to know we exist, and the regulator is looking at your letterhead either way.
Running a portfolio
Every client separate, one place to work
One client, one vault
Every client organisation gets its own isolated database schema, with its own users, credentials and findings. Not a column and a filter. Genuinely separate, which is the answer you want when a client asks.
Branded reports
HTML and PDF reports carry your logo, your colours and your company name, with secrets blanked out automatically. The deliverable is yours.
Provision in seconds
Create a client organisation and its schema is created, migrated and seeded automatically. Suspend it when a contract lapses, resume it when it renews. Nothing is deleted.
Per-client limits
Target caps, scan caps, concurrency and subscription expiry, set per client. Your operators manage the registry and have no route into client scan data.
Partner tenancy and white-label
The partner tenant model and full white-label reporting land 30 October. Branded reporting works today; this is the version built around a firm with many clients.
Multi-client console
Every client, every finding, one screen, with scans scheduled across the lot. Lands 27 November. Today you switch between client organisations.
Questions
What agencies ask first
Are you trying to replace our testers?
No, and we would not get away with it if we were. A good tester still finds things nothing automated will. What we replace is the repeatable grind underneath them: the roles, the doors, the write-up. The same person then covers more clients without working longer.
Our clients need mandated testing. Does this work?
Yes, as long as the empanelled firm is you. You sign; we do the testing underneath. We hold no empanelment of our own and will not present ourselves as holding one.
Whose name is on the report?
Yours. Logo, colours and company name come from your settings. Your client never sees ours unless you choose to tell them.
Do you sell around us?
No. We do not sell direct to a client you introduced for twelve months, and we do not quote your client below what you quoted them. The floor is $699 direct and $489 partner, and it is published so you can check.
What if we do not reach five client applications in 90 days?
Nothing punitive. The account moves to the referral tier at 15% of first-year value until it clears five, then returns to the partner rate. We would rather you signed the clients you have than padded a number.
What is not ready yet?
The benchmark publishes 3 November with the misses included, business-logic abuse lands 4 January, and the multi-client console lands 27 November. We have not published a detection rate and we are not going to invent one. What we have not proved yet →
Run one of your own clients through it.
Bring an engagement you have already delivered and the hours it took. We will walk the same application through the matrix and the evidence, and your tester can judge it against what they found by hand.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.