Continuous AppSec and agentic pentests
Find it before they do. Every day, and on demand.
Every repository you connect is scanned on a schedule, outside your pipeline — and if one goes 7 days without a scan, you hear about it. When you need proof, an AI hacker attacks the app you own and hands you the exploit.
Code scanning is free, no card. Pentests from $99, no subscription.
- No pipeline changes, nothing blocks a merge
- An alert when scanning stops
- Ownership verified before every pentest
- Proof of concept for each finding
The platform
Scanning finds it in your code. Pentests prove it's exploitable.
Findings from both land in one list, and the Agentic DAST (White Box) traces each exploit to its source line in a repository you already scan. Start with either; Team runs both every month.
Continuous AppSec
Free planContinuous means coverage, not a yearly test: every repository you connect is scanned on a schedule, and you are told when one goes quiet.
- An alert when a repository goes 7 days without a scan
- Code, dependencies, secrets and IaC, outside your pipeline
- Covers every repository you connect, pipeline or not
- Uses none of your build minutes; connect GitHub once
- AI verdicts and fixes verified by a re-scan (Team)
Agentic Pentest
From $99An agent attacks the app you own, from outside or traced through your code, and hands you a proof of concept for each finding.
- Ownership verified before every test
- Test accounts reach signed-in pages
- Agentic DAST (White Box) traces each exploit to its source line
- Results usually within two hours, one-off or every month on Team
- Audit Pentest, $990: our security team validates every finding and signs the attestation
Continuous AppSec
You'll know when scanning stops
Most security tools go quiet when scanning breaks. You get an email, a Matrix message or a webhook when any repository you connect goes 7 days without a scan. It runs outside your pipeline, so it uses none of your build minutes.
Nothing in your pipeline
Connect GitHub once. Scans run on a schedule per repo or team, in your timezone.
Absence alerts
No scan in 7 days? You hear it by email, Matrix or webhook.
Supply chain
Package inventory and SBOM export, CVEs ranked by exploitability.
Reports and evidence
Weekly digests and evidence for PCI DSS, SOC 2, ISO 27001, DORA.
| Aspect | A scanner in your pipeline | A pentest engagement | Continuous AppSec |
|---|---|---|---|
| When it stops | Silence | When the report is delivered; nothing runs until the next one | An alert by email, Matrix or webhook |
| Coverage | Only repositories someone wired up | The apps in that engagement's scope | Every repository you connect, checked on a schedule, even ones nobody has pushed to in months |
| Your builds | Uses your build minutes | Not involved | Never runs in the build |
| Pentest | A separate vendor and a scoping call | A scoping call, a quote, then a report weeks later | Same account: $99 agentic, or $990 validated by a person and signed |
| Setup | A step added to each pipeline | A statement of work for each engagement | Connect GitHub once |
How it works
Find it. Fix it. Prove it's gone.
Every AI verdict and fix waits for a person to approve it.
Find
Free planSAST, SCA, IaC and secret scanners run on your schedule.
Triage
Team planAI says whether a finding is exploitable, and why.
Fix
Team planAn AI patch passes a re-scan, then waits for you as a pull request or diff.
Ownership verified before any test
Pentests
AI pentesting for your running apps
Agentic Pentest (Black Box) or Agentic DAST (White Box), of hosts you've verified.
Add a domain, hostname or IP
Mark it staging (recommended) or production.Prove it's yours
A DNS TXT record or one file. Valid 90 days.The agent attacks
Recon, fuzzing and injection tests. Test accounts reach signed-in pages.You get proof
Each finding has a proof of concept. Add code to trace it to source.
$99 per pentest, or 4 a month on Team. Use staging: pentests can change data.
Capabilities
Every scanner, and what it finds
Five scanners free. Pentests from $99; AI review and fixes on Team.
SAST
Free planRisky patterns in your source code
Connect: CodeSCA
Free planVulnerable open-source packages
Connect: CodeSCA Reachability
Free planWhich vulnerable packages your code actually calls
Connect: CodeIaC Scanning
Free planMisconfigurations in Terraform, Kubernetes and more
Connect: CodeSecret Scanning
Free planLeaked secrets in your repositories
Connect: CodeAgentic SAST
Team planAn AI agent reads your code for issues rules miss
Connect: CodeAgentic Pentest (Black Box)
From $99Attacks your running app from outside
Connect: URLAgentic DAST (White Box)
From $99Traces each exploit to its source line
Connect: CodeURL
Security
How your code and data stay protected
Scoped tokens. Offline scanners. Human approval.
- Nonenetwork access for SAST, SCA, IaC and secret scanners
- 1 hourGitHub App token lifetime
- 90 daysper host-ownership proof
- 400lines max per AI fix
Your clone is deleted after each scan
Removed when the scan ends. AI scanners keep a working checkpoint so a run can resume.
Separate by default
Own subdomain and portal database per organisation.
Who runs this
Zeeshan Sultan, founder
A decade building, breaking and securing platforms used by millions, at companies with tens of thousands of engineers.
Every Audit Pentest finding is validated by a member of our security team before the report and the signed attestation go out. jeerc is a Cyphlon product.
Questions before you buy? Talk to us
Pricing
Code scanning free. Pentests from $99.
Scan every repository free, buy a pentest when you need one, or get both every month on Team. Every plan: unlimited seats and repositories.
Free
$0
No card, no time limit
Continuous AppSec: code, dependency, secret and IaC scanning on a schedule, outside your pipeline.
- An alert when a repository goes quiet
- 50 repositories scanned a day
- Unlimited seats and repositories
Pentest Pass
$99
One pentest, no subscription
A first look at one app you own, not audit evidence. For an audit, choose the Audit Pentest.
- Results usually within two hours
- Agentic Pentest (Black Box) or Agentic DAST (White Box)
- Proof of concept for each finding
- Credit returned if the run fails on our side
- $99 off your first Team month
Team
$349
per month, or $3,490 a year
Continuous AppSec with AI: verdicts on what's exploitable, fixes verified by a re-scan, and 4 pentests a month.
- 1,000 AI verdicts a month
- 40 AI fixes, each verified by a re-scan
- 10 Agentic SAST runs a month
- 4 pentests a month
SOC 2 or ISO 27001 audit? Audit Pentest, $990, with our security team validating every finding, a signed attestation and a re-test. Get an audit pentest Need it before an audit date? Talk to us.
Larger program? Business, $1,490 per month, or $14,900 a year, 20 pentests a month. Start with Business
Launch pricing: subscribers keep their price for 12 months, and our first 20 subscribers for as long as they stay. Prices in USD; tax added where it applies. Extra pentests are $99 each, used after the monthly allowance. Need invoicing, a security review or more? Talk to us.
Compare every limitCommon questions
What happens when a repository stops being scanned?
You hear about it. When a repository you connected goes 7 days without a successful scan (you can change the threshold), we email you, or post to Matrix or a webhook, wherever you pointed alerts during setup. A failed scan does not count as covered.
Do I have to change our CI pipeline?
No. Continuous AppSec runs outside your pipeline: connect GitHub once and every repository you pick is scanned on its own schedule, even ones with no pipeline. It uses none of your build minutes, and unchanged commits are skipped.
What counts as one scan?
One repository checked by all the code scanners at once. Free runs 50 a day, so 400 repositories are covered over about 8 days; Team runs 500 a day.
What can the GitHub App read?
Repository contents and metadata, read-only. Each scan clones with a token that lasts an hour, and the code scanners' clone is deleted when the scan ends (AI scanners keep a working checkpoint so a run can resume). Nothing is ever merged automatically.
What do I need for a pentest?
A Pentest Pass ($99) or the Team plan, the address, and proof you own the host: a DNS TXT record at _dso-verify.<host>, or the file /.well-known/dso-site-verification.txt. Proof lasts 90 days.
Will my auditor accept the report?
SOC 2 and ISO 27001 auditors generally accept an independent third-party pentest report. The Audit Pentest ($990) is built for that: a member of our security team validates every finding, we sign an attestation letter, and it is re-tested within 30 days. If your auditor has specific requirements, tell us before you buy and we will say whether the Audit Pentest meets them.
Is it safe to pentest production?
Use staging if you can. Production gets read-only rules, but some checks can still leave traces.
Do I need to share my code?
No. The Agentic Pentest (Black Box) tests your running app from outside. Add the repository if you want the Agentic DAST (White Box), which traces each exploit to its source line.
What do I get from a pentest?
A report of what the agent found, with a proof of concept for each finding. Findings join your other results, where you can retest them after a fix.
Can I trust what the agent finds?
Check it before you act on it. The Pentest Pass is fully automated: each finding comes with the agent's proof of concept, but no person reviews it, so reproduce a finding before you fix or report it. The Audit Pentest adds a member of our security team, who validates every finding before the report and the attestation letter go out.
How long does a pentest take?
The agent is fully automated and usually has results within two hours. For an Audit Pentest, a member of our security team then validates every finding, and we sign the attestation letter.
Can I pentest my clients' apps?
Yes, with their permission. Proof of ownership is a DNS record or a file on the site, so the client adds it, or gives you the access to add it, and you confirm you are authorised to test.
Can I share a pentest report?
Yes. Print the report or save it as a PDF from its page and send it on. The Audit Pentest adds a signed attestation letter for auditors and customers.
What does it cost?
Code scanning is free, no card. A pentest is $99 with no subscription, or $990 as an Audit Pentest with a validated report, attestation letter and re-test; Team is $349 a month with 4 pentests a month. Pay by card in the app and cancel any time.
Does my code go to an AI model?
On Free, no: Free runs only the code scanners, with no AI. A pentest you buy, and on Team the AI verdicts, Agentic SAST and fixes send only what each task needs to the model, through one gateway. The Agentic DAST (White Box) also reads your code.
Can the AI close findings or merge code on its own?
No. A person approves every verdict and fix; your team merges every pull request.
How do I know an AI fix works?
It must pass a re-scan by the scanner that found the issue. Patches that add a secret or exceed 400 changed lines are refused.
Do you support GitLab or Bitbucket?
GitHub only for now, including GitHub Enterprise Server.
Do you support single sign-on?
Yes: OIDC single sign-on, TOTP two-factor, roles, API tokens and an audit log.
How is my organisation kept separate?
Its own subdomain and portal database, and findings in the shared store are namespaced to it. Stored tokens are encrypted with AES-256-GCM, and the AI never receives your clone credential.
Can we leave with our data?
Yes. Export findings, verdicts, fixes, the package inventory, the audit log and SBOMs (CycloneDX or CSV).
Will this make us compliant?
No tool can. It maps evidence to PCI DSS, SOC 2, ISO 27001 and DORA, and says what it doesn't show.
Get started
Start with your code, or your app
Code scanning is free, no card. Pentests from $99, no subscription.
Works with
- GitHub
- GitHub Enterprise Server
- OIDC single sign-on
- Matrix
- Webhooks
Already have an organisation? Sign in