Skip to content
jeerc
Sign inStart free

Agentic pentests

Agentic pentests of the apps you own

An AI agent attacks a web app or host you have proved you own, and gives you a proof of concept for each finding. Results usually arrive within two hours.

Two kinds of agentic test

The Agentic Pentest (Black Box) tests your running app from the outside, the way an attacker on the internet would. It needs only the address, not your code.

The Agentic DAST (White Box) also reads the repository behind the app. It traces each exploit to the source line that caused it, so the fix starts in the right file.

How a pentest runs

  1. Add the target. A domain, hostname or IP address. Mark it staging (recommended) or production.
  2. Prove it is yours. Add a DNS TXT record at _dso-verify.<host>, or serve the file /.well-known/dso-site-verification.txt. The proof lasts 90 days.
  3. The agent attacks. Reconnaissance, fuzzing and injection tests. Test accounts you save let it reach signed-in pages.
  4. You get the report. Each finding comes with a proof of concept. Findings join your other results, where you can retest them after a fix.

Ownership is checked before every test. You can test a client's app with their permission: they add the record or the file, or give you the access to add it, and you confirm you are authorised.

Is a $99 pentest a real pentest?

It is a real test of your running app, automated by our agentic pentester (black box) or agentic DAST (white box), with a proof of concept for every finding, usually within two hours. It is not a manual penetration test and not audit evidence. For SOC 2 or ISO 27001, use the Audit Pentest.

What the Audit Pentest adds

Before you start

A pentest sends real attack traffic. It can create, change or delete data, set off alerts and use resources on the target. Test a staging copy if you can, keep current backups, and tell whoever runs or monitors the target before you start. Production targets get read-only rules, but some checks can still leave traces.

What it costs

  • Pentest Pass: $99 for one pentest, with no subscription. If the run fails on our side, the credit comes back automatically.
  • Team: $349 a month, with 4 pentests a month alongside AI verdicts and fixes for your code scanning.
  • Extra pentests: $99 each, used after the monthly allowance.
  • Audit Pentest: $990, one-off, for SOC 2 and ISO 27001 audits, with a re-test included.

Pentest a running appCompare plans