Security Testing Solutions

Start with where your risk actually sits. If your exposure is internet-facing, begin with external network testing and web application testing. If your concern is what an attacker could do after one phished credential, start with internal network testing and Active Directory testing. Most organisations end up running several together, which is what enterprise penetration testing describes.

Yes, deliberately. Cloud penetration testing reviews the configuration of your AWS, Azure, GCP and Microsoft 365 accounts, while web application and API testing exercise the applications running on top of that infrastructure. External testing finds the exposure; exposure management decides what to fix first. The pages are different views of one engine, not separate products you have to buy twice.

Anything inside your network needs the agent: internal network scanning, LAN asset discovery, Active Directory enumeration, credential testing and SSH-driven remediation. External, web application, API, cloud and Kubernetes testing all run agentless, as does continuous attack surface management. Kubernetes auditing works from a customer-supplied read-only kubeconfig, so there is no DaemonSet to install. The agent itself deploys in about 5 minutes, connects outbound-only over TLS 443 and needs zero inbound firewall rules.

A point-in-time test tells you how you looked on the day it ran. Continuous penetration testing keeps testing between those dates, with scheduled scans, 7-day asset re-verification and drift detection, so new exposure is caught as it appears. Many teams keep a deep-dive assessment for their auditors and run continuous validation underneath it. Our continuous testing explainer walks through both models.

Starter covers external, internal, web application and API testing with basic compliance mapping. Professional adds cloud posture auditing, AI-guided remediation, full compliance reporting, scheduled scans, scan comparison and team management on an isolated workload. Enterprise adds email and Microsoft 365 auditing, advanced exploitation, continuous monitoring, single sign-on, data-residency options and an on-premise deployment option. Partner and MSP arrangements are sales-led. Current inclusions and asset allowances are on the pricing page.

There is no per-solution price. Pricing is asset-wise: an asset is one thing the platform can scan or monitor, such as a public IP, hostname, web application, internal subnet target, cloud account or Kubernetes cluster, and each cloud account or cluster counts as one asset. Scans against your assets are unlimited within fair use, so testing an existing asset a different way does not add a line item. See pricing for current tiers. All paid plans start with a 7-day free trial. A card is required to start your trial and is only charged after the trial ends, unless you cancel first.

No, and we do not claim they do. Automation runs the repetitive, high-volume work: discovery, enumeration, vulnerability detection, safe exploit validation and reporting, at a cadence no human team could sustain by hand. That frees people for the creative work that automation handles poorly, such as business-logic flaws and chained abuse of legitimate features. See automated penetration testing for exactly where we draw that line.

Every solution feeds the same reporting engine, which maps findings to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes. That mapping gives your assessors technical evidence in the language they already use; it is not a certification of your organisation. Reports come in multiple formats including PDF, CSV and JSON/API, and our methodology sets out the seven phases behind them.