Cacilian — Independent Software Review

Strengthen Your Cyber Defense with the Cacilian Penetration Testing Platform

Compliance Transparency Index

Grade: B — Score: 80/100

Best For

• Security and compliance teams that need penetration testing evidence for SOC 2, ISO 27001, PCI, HIPAA, HITRUST, or customer security reviews.
• SaaS companies that want a structured PTaaS portal instead of managing scoping, updates, findings, and retests through email.
• Organizations with multiple applications, APIs, user roles, or environments that need repeatable testing workflows and in-progress visibility.
• Teams that want both human-led testing and recurring AI-assisted testing options under one Prescient/Cacilian delivery model.

Not Ideal For

• Buyers looking for a fully self-serve vulnerability scanner with instant card checkout and no SOW, since Prescient says final pricing, scope, and terms are governed by the executed SOW.
• Teams that require public SOC 2 certification or SSO documentation before vendor intake, because I did not find those controls publicly documented for Cacilian.
• Organizations that need a broad SIEM, EDR, MDR, or cloud security platform, since Cacilian is focused on penetration testing and vulnerability validation.
• Teams that need unlimited monthly testing included in one flat subscription, because Cait subscriptions include 1 test per month and up to 2 retests within 30 days of each scan.

Operational Overview

Pricing Structure

Enterprise Penetration Testing: Starting at $6,000

• Full-scope human-led engagement
• Pricing scales by applications, user roles, API endpoints, and testing depth
• Tailored to architecture, data sensitivity, and regulatory profile
• Designed for large or regulated enterprises and complex multi-application environments

Compliance Penetration Testing: Starting at $2,000

• Focused testing aligned to SOC 2, ISO 27001, or customer DDQs
• Clear audit-ready report
• Exploit-validated findings
• Designed for SMBs and mid-market teams preparing for audits or major customer reviews

Cait Unauthenticated Plan: $415/month per asset, approximately $5,000/year

• 1 unauthenticated AI pentest per month
• Up to 2 retests within 30 days of each scan
• Exploit-validated audit-grade findings with HTTP request/response evidence
• CVSS scoring and remediation guidance

Cait Authenticated Plan: $850/month per asset, approximately $10,000/year

• 1 authenticated AI pentest per month
• Up to 2 retests within 30 days of each scan
• Context-aware exploration of authenticated flows
• Proofs of concept, HTTP evidence, CVSS, and remediation steps

Additional Retests: $250 per retest

• Additional validation after remediation
• Available as an optional add-on
• Used when teams need more retesting beyond included monthly retests

Tester Lab: $150/month

• Dedicated human offensive-security expert
• Manual validation of key findings
• 1 hour of consultation per month
• Deep-dive Q&A on root cause, exploitation paths, and remediation strategy

Alternative Consideration

Consider switching to Qualys: Qualys offers a comprehensive vulnerability management solution that includes penetration testing features.

Frequently Asked Questions

How does Cacilian compare to traditional penetration testing?

Cacilian is built around a PTaaS portal instead of a one-off email-managed engagement. The vendor says customers can define scope, track testing progress, see verified findings during the engagement, and use remediation notes before waiting for a final report. Traditional penetration testing may still be better for highly bespoke work, but Cacilian is designed to make scoping, delivery, evidence, and retesting more repeatable.

How does Cacilian compare to Cobalt?

Cacilian is more closely tied to Prescient Security’s penetration testing and compliance delivery model, while Cobalt is better known as an established PTaaS marketplace with a large tester community. Cacilian is a stronger fit when audit-ready evidence, Prescient’s compliance context, and structured engagement delivery matter most. Cobalt may be stronger when a buyer specifically wants a mature on-demand tester marketplace.

How does Cacilian compare to Synack?

Cacilian focuses on structured penetration testing delivery, verified findings, remediation notes, and audit-ready artifacts through Prescient’s service model. Synack is more oriented around a large crowdsourced researcher network and continuous security testing programs. Cacilian is likely a better fit for teams that want compliance-oriented PTaaS delivery, while Synack may fit buyers who want a broader researcher-powered testing model.

How does Cacilian compare to Horizon3.ai NodeZero?

Cacilian combines human-led penetration testing workflows with AI-assisted testing options under the Prescient Security delivery model. Horizon3.ai NodeZero is more focused on autonomous pentesting and attack-path validation. Cacilian is a better fit when the buyer wants compliance-ready reports and human-led testing available in the same program, while NodeZero may be stronger for teams prioritizing autonomous security validation.

Does Cacilian support authenticated penetration testing?

Yes. Cacilian supports authenticated penetration testing, where testing is performed with user access to evaluate vulnerabilities behind login flows, internal workflows, and role-based application behavior. This matters for SaaS and web applications where the most important issues may not be visible from the public internet.

Does Cacilian support unauthenticated penetration testing?

Yes. Cacilian supports unauthenticated penetration testing that evaluates externally visible applications, services, and attack surfaces from the perspective of an outside attacker. This is useful for checking what a real attacker could probe without credentials, but it will not replace authenticated testing for issues hidden behind login or role-based access.

Does Cacilian provide audit-ready penetration testing reports?

Yes, Cacilian is positioned for compliance-driven penetration testing and audit evidence. The vendor describes compliance penetration testing as producing clear audit-ready reports with exploit-validated findings for SOC 2, ISO 27001, customer DDQs, and similar assurance workflows. Buyers should still confirm exact report format and auditor requirements during scoping.

Does Cacilian include AI penetration testing?

Yes, Cacilian is connected to Cait, also described by Prescient as CAIT or Cacilian AI Tester. Cait is an AI-assisted penetration testing service for web applications and APIs that maps application behavior, runs targeted tests, and reports exploit-validated findings with HTTP request and response evidence where applicable. For the broader Cacilian listing, AI should be treated as one testing path inside the Prescient/Cacilian delivery model, not the entire platform.

Does Cacilian integrate with Vanta?

Yes. Prescient describes Cacilian as working with Vanta in the compliance and audit workflow context, and the feature enrichment lists Vanta as the clearest documented integration. I would not describe Cacilian as having a broad public integration marketplace unless more vendor-owned integration documentation is available.

Is Cacilian fully self-service?

Not fully. Cacilian has a portal-based workflow for scoping, engagement setup, progress tracking, findings, evidence, remediation notes, and retesting, but Prescient’s pricing page says final pricing, scope, terms, and conditions are governed by the executed SOW. That makes it more structured than a traditional email-managed pentest, but not the same as an instant self-serve scanner with card checkout.

AI Visibility Report

How AI agents (ChatGPT, Perplexity, Claude, others) read this review page in the past 7 days. Updated weekly. View Cacilian AI Visibility Report.