No day rates, no per-seat maths, no plans to compare. Every run tells you how many findings there are and how serious, at no cost. You pay when you want to know what they are, where they sit and how to close them.
No high or critical finding, no invoice
One free re-test, however many findings you fixed
No subscription to cancel
The run and the count
Freealways
Add a domain, prove it is yours with one DNS record, start the run. When it ends you see how many findings there are and how serious.
Every run includes
The full run against one application and its APIs
The count by severity: critical, high, medium, low
Price, scope and how often we test are worked out with you and fitted to your application, your startup or your company — scoped in a call and quoted as one number.
Set together with you
The price, for exactly your scope
The scope, including several repositories and microservices or apps that are not reachable from the public internet
The same report, without the quarter of waiting. A traditional pentest is still the right call for hardware, mobile and highly contextual targets. For a web application and its APIs, this is what changes.
Every run ends with a count: how many findings, at which severity. That part is free, needs no card, and is enough to know whether you have a problem. What costs €199 is the findings themselves — the titles, where they sit, the proof that each one is real, and the change that closes it. You decide with the count already in front of you, so you never pay to find out whether paying was worth it.
What if you find nothing serious?
Then the run is free. We only charge when at least one critical or high finding is proven — reproduced twice, with different parameters, by a second agent. Medium and low findings are shown either way, at no cost, and you keep all four reports. A clean run is a result you can show a customer, not an empty invoice.
How does the free re-test work?
It is one re-test, not one per finding: mark everything you fixed, start it once, and it checks all of them together. It belongs to a paid run — it verifies that you fixed what you paid to see. If nothing critical or high was proven, the run cost nothing and there is nothing to re-test; start a new run whenever you ship something that changes the picture.
What counts as critical or high?
A score of 70 or above on our 1–100 scale, which multiplies four factors: how far the attack reaches, how sensitive the data is, how reliably it reproduces, and who can trigger it. Reachable customer data is the heaviest case — but takeover-able accounts, bypassable permissions and executable code count the same. The score is computed, not assigned by hand, and the severity label follows from it.
Do you need access to my source code?
No. By default everything is tested from outside, exactly like a stranger would. Connecting a repository or an OpenAPI spec makes coverage deeper, because the agents then understand your roles and data flows — but it is optional, and access is read-only.
Is it safe to run against production?
Testing is external and non-destructive, rate-limited, and preceded by pre-flight checks. Agents stop at the first proof instead of digging deeper, and one button kills every agent instantly. You can also point a run at staging.
What stops it from going too far?
You list which domains may be attacked and which are only in scope for observation. When a finding could be chained into something worse, the run pauses and shows you the analysis — it only escalates if you press the button.
How is this different from a vulnerability scanner?
A scanner reports what looks wrong. Here, a second agent has to reproduce the attack before the finding is written up at all — and if it cannot, the finding is dropped. That is the difference between 1,428 lines and six.
Will an auditor accept the report?
Yes. The full report contains every finding with technical detail, proof of exploit and remediation guidance, structured for SOC 2 and ISO 27001. There is also a customer-facing version that proves your posture without exposing your stack.
What exactly does “no findings, no cost” mean?
If a paid test produces nothing rated high or critical, we do not invoice it. You still get the written clean bill you can send to a prospect. It applies to every per-test run.
How long does a run take?
Most finish within a few hours, and the report is available the same day. You can watch the agents work live rather than waiting for an email.
Do I have to prove I own the domain?
Always. One DNS TXT record, checked before the first run and re-checked before every later one. Remove the record and testing stops.
See the count first, then decide.
Starting a run needs no card and no call. And if nothing critical or high is proven, the test costs nothing either.
