As digital applications become increasingly important to business operations, maintaining their security before production release is essential. A pharmaceutical manufacturer manages web applications that require security assessments before launch. Its internal security team is responsible for reviewing these applications and identifying vulnerabilities before they go live.
To make testing more flexible and sustainable, the company needed an approach that could support on-demand assessments without relying on external providers for every cycle. Previously, vendor or SaaS-based penetration testing cost approximately USD 1,000 to USD 2,500 per application and took around two weeks to complete. Limited internal capacity made repeated assessments more challenging.
Challenges: Making Application Security Testing More Cost-Efficient and Flexible
Before implementing the solution, the company relied on external vendors or existing SaaS services to conduct penetration testing. Each application assessment involved a recurring service cost, making frequent or ad hoc testing expensive. Across multiple applications, this approach could place additional pressure on the company’s IT and security budget.
The process also took around two weeks, while the company’s internal security team had limited capacity to conduct every assessment independently. Engaging external providers for each testing cycle affected how quickly assessments could be initiated. The company needed a solution that could automate key testing activities, produce clear findings, and be operated by its own security team.
Solutions: Automating Penetration Testing with PentAGI and Amazon Bedrock
To address these challenges, CDT implemented an automated penetration testing solution using PentAGI, an open-source AI-powered penetration testing agent, integrated with Amazon Bedrock. PentAGI performs the security testing, while Amazon Bedrock provides the foundation models that support the agent’s reasoning and task execution. The solution runs on two Amazon EC2 instances: one hosts PentAGI and the other runs LiteLLM, an AI gateway that routes model requests to Bedrock and applies spending limits.
AWS Site-to-Site VPN connects the AWS virtual private cloud (VPC) with the company’s previous cloud provider development environment, allowing PentAGI to reach authorized application endpoints through a private network path. Testing is restricted to company-owned applications in pre-production, rather than public or third-party targets.
CDT followed its four-phase methodology: Assess, Design, Build, and Operate. The team first reviewed the company’s readiness, application environment, and security requirements, then designed the architecture and its security and cost controls. CDT deployed and configured the EC2 instances, PentAGI, LiteLLM, Bedrock integration, and VPN connection. A pilot validated the complete workflow, from reconnaissance to findings report generation, before production use.
Supporting AWS services strengthen security and day-to-day operations. AWS Systems Manager Session Manager provides administrative access, AWS KMS encrypts storage, and Amazon CloudWatch monitors infrastructure performance. AWS Backup provides EC2 snapshots, while AWS Budgets, AWS Lambda, LiteLLM spending controls, and Amazon EventBridge help manage inference spending and shut down EC2 instances outside operating hours.
For each assessment, the company’s security team selects an application and defines its testing scope in PentAGI. The agent coordinates specialist tasks such as reconnaissance, endpoint enumeration, and vulnerability identification, while LiteLLM routes model requests to Amazon Bedrock. PentAGI then generates a structured findings report with vulnerability details, severity ratings, supporting evidence, and any areas that could not be tested. The security team reviews the findings and decides on remediation actions.
Results: Improving Testing Cost, Speed, and Security Operations
By using PentAGI with Amazon Bedrock, the company reduced the cost of testing the same application from approximately USD 1,000–2,500 through vendors or existing SaaS solutions to around USD 500 per application, including EC2 and Amazon Bedrock usage. This represents an estimated cost reduction of 50% to 80% for each application assessment, meeting the target of at least 50%. Both cost and turnaround were measured against the company’s previous vendor quotes and timelines for the same application.
The solution also shortened testing turnaround time from approximately two weeks to one day, within the target of one week. Automating the testing workflow and report generation allows the security team to review the results without having to carry out or repeat every testing step manually.
The operating model has also changed. Previously, the company engaged external providers for each penetration testing cycle. Following the initial implementation and knowledge transfer, its internal security team can now initiate and operate subsequent assessments using PentAGI, reducing the need for vendor involvement in recurring tests.
CDT’s Agentic AI Solution to Strengthen Application Security
By implementing PentAGI with Amazon Bedrock, CDT helped the company establish a more cost-efficient and internally manageable approach to application security testing. Lower testing costs, faster turnaround, and the ability to run assessments on demand support a more consistent pre-release security review process. To explore how a private AI chatbot could work with your organization’s documents and requirements, contact Central Data Technology.
