The pentest engine, under the hood
A signed SOC 2 report,
and the pentest that earns it.
Your agent builds the controls. This engine attacks your live app every month, from a URL or from your repo, proves every finding with the request that triggered it, and opens the fix as a pull request. An independent US CPA signs the report your buyers keep asking for.
Free to set up. The AI pentest is included in the $299 a month subscription.
How you run it
One engine, four ways to use it.
Same plan, same monthly pentest. Pick by how much access you give it.
Attack your live app with nothing but a URL. The fastest way to start.
Read more › Deepest coverage White-boxRead your code first, then attack. Finds the deep bugs an outsider never reaches.
Read more › In your editor MCP serverStart and read pentests from Claude Code, Cursor, Codex or any MCP client.
Read more ›A pull request straight to your GitHub that patches the vulnerability it just proved. Replay confirms the fix held.
Watch a run
This is an attack, not a scan.
It hits the target while you watch the timer climb and the moves roll in.
A Compliance Everywhere live pentest in progress: the engine attacking a sample target, a running timer, a feed of attack moves, and a step-by-step pipeline.
What you get
Proof you can copy, and a fix you can ship.
Each bug lands in your tracker with three things.
- 01The exact request that triggered it.
- 02A screen recording of the exploit.
- 03The diff that closes it.
Run it yourself in 10 seconds. No exploit, no finding. Not a 400-page PDF.
See a sample report›
Frequently asked
Questions.
01What do I actually get?
A SOC 2 Type I or Type II report signed by an independent AICPA-member CPA. To get there, your agent builds the controls, and this engine runs a penetration test against your live app every month. The pentest is included, not a separate engagement.
02Who signs the report?
An independent US CPA firm that is an AICPA member. They contract with you and bill you directly, and we never take a share of that fee, because a fee split would compromise the independence that makes the report worth anything.
03Do I have to talk to sales?
No. Sign up, point it at your app, and launch your first pentest yourself. Most teams run in minutes.
04How is this different from a scanner?
Scanners flag thousands of maybes. We run real attacks and only report what we actually broke, with proof. It replaces the people you would hire to break in by hand, not your scanner.
05How do I know the findings are real?
Each one comes with the exact request that triggers it. Run it yourself. If it does not reproduce, it is not a finding.
06Can it open the fix as a pull request?
Yes, if you turn on write access. By default we are read-only and just hand you the fix.
07What does it cost?
The AI pentest is included in the $299 a month subscription for startups under 10 people. The human pentest auditors expect is $1,500, one time. Teams of 10 or more book a call for rollout pricing.
Point it at your app.
Findings by tonight.
Free to set up. The first AI pentest runs the day you connect.