An autonomous security testing platform built in Graz. We exist because the gap between a five-figure pentest and a free scanner is where most SaaS companies actually live.
Year founded, in Graz, Austria.
Every finding is reproduced before it is written up.
From starting a run to an audit-ready report.
A proper penetration test costs five figures, takes six weeks to schedule and arrives as a 120-page PDF written for auditors. Most teams below fifty people never book one.
The alternative is a scanner. It runs in four minutes and hands you 1,428 findings, most of them duplicates, most of them wrong. Nobody reads it twice.
So the surface goes unchecked — and it moves with every deploy. In the runs we did while building this, the same three things kept coming back: a live API key in a front-end bundle, customer files reachable through predictable URLs, and an auth flow that forgot to expire something. None of them are exotic. All of them put customer data in reach.
What changed is that testing no longer needs a calendar. Agents can map an application, attack it from hundreds of angles at once, and — the part that actually matters — prove a finding by exploiting it a second time before anyone is bothered with it. That is the product: coverage of a real pentest, at the speed of a scanner, with a report short enough to get fixed.
Our goal is software that keeps testing itself. Ship, get attacked by your own tooling, fix it before a stranger gets there.
The scope and the price appear before a run starts. No day rates, no invoice that arrives larger than the estimate.
Shown before you confirm
A finding gets written up only after a second agent reproduces the attack. We would rather report six things than flag six hundred.
No triage queue for you
Nothing high or critical means no bill — and you still get the written clean bill to show a customer.
Every per-test run
We store what proves a finding, not your customers’ records. Stored on EU servers only, and no client is named without written permission.
NDA by default
Evidence and reports are stored in the EU — machines in Frankfurt, object storage in EU jurisdiction, keys in eu-central-1. The model that drives the testing agents runs outside it, as do sign-in and mail delivery. Signed DPA on request.
Adding a domain takes one DNS record, and every run tells you how many findings there are and how serious — at no cost. That is usually enough to find out whether you have a problem.