XBOW penetration testing: what it costs now and who it fits

By The PenTest Index

XBOW penetration testing is AI-run testing of web applications and their APIs: software agents attack your app and report the flaws they can prove. It no longer has a public per-test list price. XBOW retired its self-serve Lightspeed tests on July 16, 2026, and its own pricing page now directs you to a quote. One public figure: a $50,000, 12-month credit package on AWS Marketplace.

Checked October 9, 2026. We read XBOW's public pricing, documentation, terms and marketplace listing. We did not buy or run a test.

Our read, in short:

• Put XBOW on your shortlist if you want repeat testing of a web app that can be reached from the internet, and an annual usage contract works for you.
• Look elsewhere if you need one test at a known price, your target is an API with no web app in front of it, or the person asking for the report needs people to do the testing.
• Settle this first: ask whoever needs the report whether AI-run testing is acceptable to them. XBOW cannot answer that for you, and neither can we.

Already set on XBOW? Its own pricing page now directs you to a quote. Take the questions further down with you.

Request a quote from XBOW

Is XBOW penetration testing the right fit for you?

It fits when four things line up: the target is a web app, XBOW can log in to it, the buying terms work for you, and your report recipient accepts AI-run testing. Here is how that plays out against a made-up but typical buyer.

The example: Say you run a 30-person software company. You have one web app and its API, with member and admin roles and separate customer accounts (tenants). You have a SOC 2 audit in March, and a customer is asking for a recent pentest report. This is not a real client. It is a worked example.

We took each thing this buyer needs and checked it against what XBOW publishes. "Supported" means XBOW's own page backs up that one point. It does not mean the test is good or that anyone will accept the report.

What this adds up to: XBOW is a real candidate for this buyer, on one condition. The asset type and the documented report formats check out. The open items are the exact scope, login access, price, the report date, access testing between customers, and the recipient's yes. So the next move is a quote request with those questions in it, not more reading about AI versus humans. If the answer comes back as "annual contract only, close to the marketplace price," this buyer should compare offers that publish a per-test price.

Which route fits your situation?

Find your row. Each one tells you what to do next.

Scope an API test with Cobalt

Scope a human-led web app test with Cobalt

Cobalt is named because its service pages, read October 9, 2026, describe those two kinds of work. Both are quote-only. That is not a promise its proposal will fit you.

Most of what is still open comes down to your own scope: which apps and APIs, which roles, who needs the report, and by when. Write that down once and you can put the same questions to XBOW and to anyone else, so the answers line up. Find My PenTest Match gives you a free scope checklist to copy or print. It asks for no contact details, and it does not pick a provider for you.

Find My PenTest Match

How much does XBOW cost now?

XBOW's own site shows no current per-test price as of October 9, 2026. Its pricing page says "Pricing is scoped to your environment" and offers a quote form. The only public number we found is on AWS Marketplace.

Two plain bits of math, so you can size it:

• $50,000 ÷ 12 = $4,166.67 a month if you spread it evenly. The listing says you pay upfront or in installments under your contract, so what is due on day one is not known.
• $50,000 is 12.5 times the $4,000 starting price in XBOW's 2025 announcement. These figures describe different purchases: an annual credit package and a historical test starting price. It is not a per-test rate, because the listing does not state how many tests the package buys.

A list price on a marketplace is a starting point. Your quote could be higher or lower. Until XBOW tells you how many credits a test of your app uses, treat the total as unknown, not as zero and not as $50,000.

What happened to the $4,000 XBOW pentest?

It was retired. XBOW launched a self-serve test called Lightspeed Pentest On-Demand in November 2025. The launch blog post now carries this note: "Lightspeed has been deprecated as of 2026-07-16." The old buy page, xbow.com/pentest, now lands on a demo request form.

XBOW's own launch pages do not agree on the price, either:

An outside study published in May 2026 also recorded XBOW's entry "Plus" tier as listed at $4,000 (more on that study below). So the $4,000 figure was real at one point. It is just not something you can buy today. If a page or an AI answer relies on those $4,000 or $6,000 launch prices, it is quoting a retired product.

What do XBOW's public terms commit you to?

By default under XBOW's website terms: fees are invoiced annually in advance and are non-refundable subject to the stated remedies, and XBOW's direct-damages liability is capped at fees paid or payable in the prior 12 months. Your signed order form can change these, and it wins where the two differ. The AWS listing links a separate Standard Contract for AWS Marketplace; check the terms attached to your purchase.

This is our summary of a public document, not legal advice. If your app holds health or payment data, have a lawyer read Section 7.c before you test.

What does XBOW test, and will it work with your app?

XBOW tests web apps you use in a browser, plus the APIs behind them. Whether it works on your app depends on three checks: what the target is, how you log in, and how your user permissions are set up.

What if you only need an API tested?

Then XBOW's standard product is not the fit. Its docs say plainly: "XBOW does not support testing APIs without an interactive web application." An API is how one piece of software talks to another. A web app is the part a person clicks through in a browser. XBOW needs the second to get to the first.

XBOW does have its own API for starting tests from your build tools. That is a way to control XBOW. It does not make an API-only product a supported target.

Will XBOW work with your login?

Probably, unless you depend on text-message codes, Google sign-in or CAPTCHA. Here is what XBOW's docs list.

The app also has to be reachable. If it sits behind a VPN and you cannot let XBOW's traffic through, XBOW's docs list that as incompatible.

Does XBOW test whether one customer can see another's data?

It can, but check that it is in your plan. This kind of flaw has a clumsy name, IDOR (insecure direct object reference). In plain terms: can user A open user B's records just by changing an ID in the address?

XBOW's docs describe giving it up to four extra test accounts so it can learn who should see what. The primary account is used for discovery and all attack types; extra accounts are used only for IDOR-specific attacks. The feature is labeled "public preview," which means it can change. For the 30-person company in our example, the question is concrete: can a member in one customer account reach another customer's data, or use an admin-only action? Ask XBOW which of those cases will show as tested in the report.

Is XBOW a scan, an autonomous pentest or human-led testing?

It is autonomous testing. That sits between a scan and a human-led test, and the difference matters when someone else has to accept your report.

• A vulnerability scan checks for known weak spots and gives you a list of maybes.
• Autonomous testing, which is what XBOW sells, has AI agents try real attacks. A separate automated step confirms an exploit works before it is reported as a validated finding.
• A human-led assessment has people doing the testing.

XBOW's docs split results into two kinds. "Validated" findings come with a working attack and steps to repeat it. "Informational" findings are things it "cannot definitively exploit." The docs also say XBOW "may not comprehensively test all endpoints in a single assessment." So a clean result means nothing was proven in what got tested. It does not mean the whole app was covered.

Where do people come in? XBOW's AWS page says every engagement includes a final review by a human security expert. Its docs also show a status for a finding an XBOW reviewer has confirmed. We found nothing saying a named person runs the test. If your contract says "performed by a qualified tester," ask your recipient whether a final review counts. For many it will. For some it will not.

XBOW's track record is its own to state: it says it reached #1 on HackerOne's US leaderboard in June 2025 and works with 150+ security teams. Those are company claims. They tell you the engine is serious. They do not tell you what it will cover on your app.

Will an auditor or customer accept an XBOW report?

That is your auditor's or customer's decision. XBOW gives you the documents. It does not, and cannot, promise the yes.

Here is the gap to know about. XBOW's platform page says results come as "reporting your board and auditors accept." XBOW's terms say there is no warranty the results will meet anyone's requirements. The first is marketing. The second is the contract. Plan around the contract.

Send your recipient this before you buy:

"We are looking at an AI-run penetration test of our web app and API, with a final human review, a full report, an executive summary and a signed letter of attestation. Will that satisfy your request? If not, what is missing?"

XBOW publishes customer stories about using its reports for SOC 2. Those are XBOW's own pages about other companies' auditors. Yours may see it the same way or may not.

One detail for later: a finding marked "Fixed" in XBOW means one retest could not repeat the attack on the day it ran. XBOW's docs say that if the flaw shows up again later, the status stays "Fixed" and only the "Last seen" date moves. Before you hand over a report as proof of a fix, compare those two dates.

Are retests included, and when will the report arrive?

Retesting exists. What it costs you and when the report lands are not published, so get both in writing.

Retests. After you fix something, you start a retest. XBOW "will try the original exploits and, if those fail, will attempt alternative approaches." When all selected retest assessments are complete, a new version of the report is generated. What the docs do not say is whether a retest uses up credits, or whether there is a deadline. Ask both.

Timing. The promise of a report "within five business days" belonged to the retired Lightspeed product. Today's docs say run time "varies according to the asset size and your configuration decisions," and that a new test may wait in a queue if you already have several running. If you have an audit date, work backward: setup and access, the test, the first report, your fixes, the retest, the final report. Then ask XBOW for a date for your scope.

What does independent testing of XBOW show?

There is one hands-on study worth knowing, and it comes with strings attached. It shows XBOW found real flaws with very few false alarms. It cannot tell you what XBOW will find on your app today.

The security firm Doyensec ran XBOW and a rival product, Aikido, against the same two open-source web apps in March and April 2026, then checked every finding by hand. Its paper, published May 27, 2026, reports:

• XBOW: 31 confirmed findings and 1 false positive across the two apps.
• Aikido: 49 confirmed findings and 2 false positives.
• Buying XBOW: setup needed sign-off from XBOW's sales team, and one test took more than 22 support emails and over a week.

Read it with three cautions. Aikido paid for the study, and the paper says so. The two tools were set up differently: XBOW ran with a single login, because it did not support multi-user testing at the time, and it has since documented extra accounts. And the authors say the results are not "generalizable" and were not meant to compare either tool with human testers.

The useful lesson is about method. When anyone shows you a comparison, ask whether both sides had the same scope, the same accounts and the same limits.

Is it safe to run XBOW on a production app?

XBOW gives you real controls, and it is also honest that testing "exercises real functionality in your asset, which means it can trigger real consequences." You decide where the limits are.

What XBOW's docs let you set before a test:

• Scope. Which sites it may attack, which it may only visit, and which pages it must never touch, such as account deletion or payments.
• Hours. Business hours, off-hours or your own schedule.
• Speed. A cap on requests per second. XBOW suggests starting at 250 and going lower for a fragile app.
• How far it pushes. Off, Moderate or Deep. XBOW calls Moderate the right default for most production apps. Deep is for cases where you have explicit sign-off for it to move across systems.

XBOW also says a second AI model screens each command for destructive actions, and that testing pauses on its own if your app goes down. Scope, protected pages and the speed cap cannot be changed once a test starts, so set them with care.

Use a dedicated test account with normal-user rights. Your data is hosted on AWS in the United States by default. XBOW says European and Singapore hosting are in private preview, and that it does not train AI models on customer data without permission.

One thing this page is not: permission to test anything. Before any test, you need written authorization that covers the exact systems and the exact activity.

Questions to send XBOW before you buy

Send these in writing with your quote request. Each one closes a gap we could not close from public pages.

We are evaluating XBOW for [app and its APIs], in [environment], with [user roles and customer accounts]. The report is for [auditor or customer] and is needed by [date].

Please confirm:

1. Do you sell a single assessment of one application? If so, what is the total price?
2. For a 12-month contract: the total commitment, the amount due at signing, what triggers extra charges, and whether unused credits expire.
3. How many credits a full assessment of an app like ours uses, and whether a retest uses credits or has a deadline.
4. The report delivery date you will put in writing.
5. Which human review is included in our offer, and who signs the letter of attestation.
6. Whether multi-account access testing is included, whether it is still in preview, and which roles and customer accounts the report will show as tested.
7. Whether our login method, [method], is supported for the test account.
8. How the "Sensitive Data" clause in your terms applies, given our app holds [type of data].
9. A sample report and letter of attestation we can show our auditor.

Please also tell us anything you have assumed or left out, so we can compare written offers on the same scope.

Copy questions

Keep passwords, API keys and details of known flaws out of this message. Agree a secure way to share access once you have chosen a provider.

Request a quote from XBOW

If you need a published price instead

If quote-only does not work for you, these offers publish a price for testing one web app. We read each provider's own page on October 9, 2026. They are listed A to Z within each group, not ranked, and we have not bought or tested any of them.

Tests led by AI

Tests led by people

All prices are shown as published on each provider's page. A refund promise is not the same as your auditor saying yes, so the question for your recipient still applies.

Compare all published offers side by side

Other questions

Does XBOW have a free trial?

The AWS Marketplace listing shows a "free trial" option, but it does not say what the trial includes. XBOW's own site offers a demo. Ask XBOW what a trial covers and whether it can run against your app.

Is XBOW Lightspeed still available?

No. XBOW's launch post says Lightspeed was "deprecated as of 2026-07-16," and the old order page now leads to a demo form.

Can XBOW replace our annual pentest?

Only your report recipient can say. If they accept AI-run testing, XBOW may cover it and let you test more often. If they need people to do the testing, keep that test and treat XBOW as extra coverage between rounds.

Sources and how we checked

We read every source below on October 9, 2026, and we link each one where we use it. Everything about XBOW's offer is what XBOW publishes. The findings are our own reading of those pages against a stated need, which is the method we call the PenTest Index Purchase Check. More on that in how it works.

We have not bought, trialed or run XBOW. We have no commercial relationship with XBOW or any provider named on this page. See how we make money.

• XBOW: pricing, platform, AWS page, launch blog post, news announcement, terms and conditions
• XBOW documentation: choosing an asset, asset types, authentication methods, reports, findings, interpreting results, retesting, running an assessment, protecting assets, trust and safety
• AWS Marketplace: XBOW Enterprise
• Doyensec: Comparing AI Application Security Testing Platforms (sponsored by Aikido; published May 27, 2026)
• Other providers' pages: Astra pricing, Intruder pentest pricing, Synack pricing, Pentest-Tools.com web app testing, Cobalt web app pentest, Cobalt API pentest

Prices and terms change. If something here no longer matches a provider's page, the provider's page is right and we want to fix ours.