Manual penetration testing by CREST, OSCP and OSWE-certified testers. Every finding arrives with a working proof, published to your portal the day it is confirmed.
[ 01 / How it runs ]
AI-powered pentesting
01
Automated discovery, exploitation of known classes, and AI triage. A tester reviews the queue before anything reaches you. Built for the gap between engagements, when your codebase keeps moving.
From
$399/ scan
Manual engagement
02
A certified tester works your target by hand for days, chaining findings until each one has a working proof. This is what auditors, enterprise buyers and your own board mean when they say penetration test.
From
$700/ engagement
[ New ]
For qualifying manual assessments where we have full access. If the engagement produces no High or Critical findings under the agreed classification, we refund 100% of the assessment fee back on your invoice. Confirmed in writing before we touch a packet.
Applies to grey box and white box engagements. Excludes black box, scans, and retests. Terms set in the engagement letter.
[ 02 / Coverage ]
[ 03 / Engagement ]
A short call, then a written scope with a fixed price. If the scope does not change, the number does not change.
1-2 daysAutomated discovery maps your attack surface and clears the noise, so the tester starts the engagement already oriented.
AI-acceleratedA named, certified tester works the target by hand, chaining findings until each one has a working proof rather than a maybe.
3-15 daysFindings appear in your portal as they are confirmed. Your team can start fixing on day two instead of waiting for a PDF.
LiveA working session with your engineers. We walk the attack paths, answer questions, and agree what gets fixed first.
90 minutesOnce you have fixed things, we verify every finding again and reissue the report and letter of attestation.
Included, 90 days[ 04 / Platform ]
The six-week PDF is a habit, not a requirement. Confirmed findings publish to your tenant the moment they are verified, so remediation starts on day two rather than after the engagement ends.
| ID | Severity | Finding | ||
|---|---|---|---|---|
| VPQ-0142 | Critical | 9.8 | Fix in review | |
| VPQ-0139 | High | 8.1 | Open | |
| VPQ-0131 | High | 7.5 | Open | |
| VPQ-0128 | Medium | 6.4 | Retested, closed |
Illustrative data · select a row to see what your team sees
Published as they are confirmed, with reproduction steps and evidence attached.
Comment on any finding and get an answer from the tester who wrote it, not a support queue.
[ 05 / Who tests ]
[ 06 / What we look for ]
Access control
Critical
One account reaching another tenant's data. We prove the full path, then hand you the exact request to reproduce and fix.
Authentication
Account takeover
A token you can guess is an account takeover waiting to happen. We show the guess, the takeover, and where the entropy went wrong.
Attack surface
Unknown exposure
You cannot defend what you have not counted. We map what is actually exposed and assign ownership in the debrief.
[ 07 / Questions ]
No. AI does reconnaissance, enumeration and first-pass triage, the mechanical work that used to eat the first two days of every engagement. Exploitation, chaining, impact analysis and the report itself are done by a certified tester whose name is on the document. We would rather be slower than pretend otherwise.
Because the recon that used to be billed by the hour is now largely automated, and because we do not run a sales team. $700 is a genuine small-scope external test with a real tester on it, not a scan with a logo on the front page. Larger scopes cost more, and you see the number before you commit.
Testers holding CREST CRT, OSCP, OSWE, BSCP, CRTO and CRTP. You are told which tester is assigned to your engagement before it starts, and you can talk to them directly through the platform while it runs.
Yes. Reports follow the structure auditors expect, findings carry CVSS v4.0 scores and reproduction steps, and every engagement includes a letter of attestation you can share with customers without handing over the full technical report.
An AI-powered scan runs within 24 hours of scope confirmation. A manual engagement typically starts within five to ten working days, and we hold slots for existing clients who need a retest before a launch.
Evidence lives in the platform, encrypted at rest, in a tenant only your team and the assigned testers can reach. You can export everything at any time, and we destroy engagement data on request or on the schedule agreed in your contract.
Thirty minutes on a call is usually enough to scope an engagement and give you a fixed price. No pipeline, no sales engineer. You talk to someone who tests.