Trial

A trial that runs against a target of your own

Request your $299 B-52 trial for one application or target. We’ll confirm what the assessment covers and the testing authorisation, then send payment details. Once payment and scope sign-off are complete, B-52 runs the assessment and delivers your report.

Request $299 Trial Discuss a Larger Assessment

Two trials

Only one of them has a button

They are different things, and the difference is worth knowing before you go looking for a control that is not there. One is a $299 paid trial you request for one application or target. The other is arranged on a call, and only on a call.

Trial	How you get it	What it is
Paid trial, $299	Request the $299 trial	One scan of one application or target, in one of the five coverage classes available by request. We’ll confirm the scope and authorisation before testing begins.
Free trial	Request a call	Sales-qualified only. It is agreed in a conversation about your estate, and there is no free-trial button anywhere on this site.

Paid trial, $299

How you get it: Request the $299 trial
What it is: One scan of one application or target, in one of the five coverage classes available by request. We’ll confirm the scope and authorisation before testing begins.

Free trial

How you get it: Request a call
What it is: Sales-qualified only. It is agreed in a conversation about your estate, and there is no free-trial button anywhere on this site.

If the free route is the one you want, ask for it directly: the contact page reaches the same people who scope engagements, and it is a shorter path than working out which button on this site might have been the free one.

The comparison

A free penetration test exists in this category

One platform in the competitive set gives away a complete penetration test with no card at all. Conceded, plainly, because you would find it in the time it takes to open a second tab, and nothing further on this page argues with it.

What is worth saying instead is the other half of the sentence, which is what the $299 is spent on. It is spent on a target you nominate and authorise: your application, your API, your release build. The six phases that run against it are the six that run against a bought engagement, and every finding that comes back carries the request, the response and the steps that reproduce it.

That is the thing to compare, and it is not the price on its own. A run against the application you are shipping this quarter is the only run that tells you what is wrong with it, and that is what the $299 is spent on.

The run

What $299 actually sets in motion

In the order it happens: what is fixed before anything starts, what runs, and what you are left holding when it finishes.

01 Before it runs

One target of yours, and nothing deployed to reach it

What you nominate: One application or target. That is the same unit every other scan is sold in, so a trial scan and a bought scan are the same size of thing.
What has to be true of it: The coverage class has to be one of the five available by request. Where it is not, the scan is still run, as a scoped engagement agreed on a call first.
What gets deployed: Nothing inside your network. External and application testing needs no deployed position at all, and internal testing, which does, is a scoped engagement rather than a single-target request.

02 The run

Six phases, and the sixth runs on the finished report

The five that do the work: Discovery, planning, scanning, exploitation, reporting. Each one feeds the next, and exploitation is where a candidate stops being a signature match and becomes a finding somebody can reproduce.
The sixth: QA, run on the finished report before it reaches you. It is a phase of the engagement instead of a read-through at the end, which is why reporting is not the last thing that happens.
What the trial changes about them: Nothing. The same six phases run, in the same order, against a trial target as against any other. The price is the variable here; the method is not.

03 What you keep

Evidence per finding, and a closure that is an event

Behind every finding: A reproducible exploit artefact: the request that produced it, the response that came back, and the steps to reproduce. Severity as a CVSS v4.0 vector, and the CWE it maps to.
Afterwards: Findings carry open, fixed, retested and closed. A finding closes on a retest that cannot reproduce it, which is a different event from somebody marking it done.
Why this is the half worth paying for: A finding an engineer can act on without asking what it means, and a closure they cannot argue with. That object is what the $299 buys, and it is the same object a $500 scan buys.

The phase sequence is described in full on how it works, and what an individual finding has to survive before it is written down is on validation and proof.

Available by request

Five classes, available by request

B-52 accepts single-target assessment requests for web applications, mobile apps, APIs, thick clients and secure code review, and these are the classes a trial can be requested for. Each links to its own page, where the defect classes, the standards and the worked example for that class are set out.

Coverage class	What one scan of it is
Web application	We need the application you nominate and a login for each role inside it. One user’s reach is only testable against another user’s.
Mobile app	The build you already published, signed as it stands, pulled apart and read back without anybody handing over source.
API	One interface. What each route is meant to allow is settled on paper first, then put to every route in turn.
Thick client	The package you ship, on the assumption an attacker already holds a copy of it, and the server behind it tested on that assumption.
Secure code review	One codebase, not one running copy of it, which is why a finding arrives as a line of code and the edit that shuts it.

Web application

What one scan of it is: We need the application you nominate and a login for each role inside it. One user’s reach is only testable against another user’s.

Mobile app

What one scan of it is: The build you already published, signed as it stands, pulled apart and read back without anybody handing over source.

API

What one scan of it is: One interface. What each route is meant to allow is settled on paper first, then put to every route in turn.

Thick client

What one scan of it is: The package you ship, on the assumption an attacker already holds a copy of it, and the server behind it tested on that assumption.

Secure code review

What one scan of it is: One codebase, not one running copy of it, which is why a finding arrives as a line of code and the edit that shuts it.

The other six (external network, internal network, cloud, Active Directory, social engineering and applications built on a language model) are scoped engagements: for broader scopes or other assessment classes, an engineer will work with you on a tailored assessment plan. Each needs something agreed first: a deployed position, an authorisation naming a population, a movement boundary. That is a routing rule. All eleven classes are tested, all three delivery models cover all eleven, and the coverage index lists every one of them.

After it

One scan is one scan

The trial buys a single scan of a single target. Outside the trial, the entry price for one scan of one application or target is $500, and it is requested the same way, for the same five classes.

Beyond one target, three things move: how many targets or applications are in scope, how often they are tested, and which delivery model the engagement runs in (whether a senior auditor verifies each finding, or runs the engagement outright with B-52 underneath). Those three settle an estate faster in conversation than a page can guess at. What one scan covers sets out the unit and the axes, and the delivery models page explains whose signature each one puts on the report.

The two published figures, and what they cover As of October 2026

$299 is the trial: one scan, one target, available by request.
$500 is the entry price for one scan of one application or target outside the trial.
One scan is one application or target, inside the trial and outside it. The unit does not change with the price.

Deliberately excluded

Every figure above the entry price. The number of targets, the test frequency and the delivery model all move it, and the combination is settled on a scoping call, not published as a range.

Pick one target and start there

Where the report has to carry an auditor’s signature, or the estate is larger than one application, the call is the shorter route. Everything else starts with a request and a target.

Request the $299 trial Request a scoping call