AI agents pentest your web app and API, only inside the scope you sign.
The agents test the way a person would: signing up, logging in, working from a real browser. Every finding comes with a working exploit, and nothing outside the hosts you sign is touched.
Plans from€99a month
Start my free checkHow a pentest runsRead-only, about 20 minutes. The written report arrives by email within one business day.
Cloud ProgramSample data, acme.example. The signed scope covers shop and api, 16 endpoints. Agents probe inside it; a probe that reaches the wall stops there and turns back. mail, vpn, status and intranet sit outside it, never touched.
- Sep 14HostGator LATAM Bug BountyAuthorization Bypass (User-Controlled Key)target withheld until the program disclosesMEDIUM
- Sep 18Web.com Bug BountyBroken Access Control (BAC)target withheld until the program disclosesHIGH
- Sep 26AkuaImproper Exception Checkstarget withheld until the program disclosesMEDIUM
- Sep 26ABC LevelAccess JWT not revoked on logout — stolen token stays valid for full 5-min TTL after user logs outLOW
- Oct 07Meta Bug BountyCWE-295target withheld until the program disclosesLOW
- Oct 17toom Baumarkt GmbH - WebshopBusiness Logic Errorstarget withheld until the program disclosesHIGH
Titles and targets stay redacted until the program discloses.
A scanner stops at the login form.
Most of an app sits behind an account and a bot gate. Reaching it means behaving like a person using it, so the hunt does the whole sequence the way a tester would.
- 01opens the app in a real browsernot a headless request loop with a spoofed header
- 02registers its own accountrecorded in a per-hunt ledger, reused by later passes
- 03reads its own verification mailthe link is followed, the account is confirmed end to end
- 04clears the bot gateattempted in the browser, then solved when the fingerprint loses
- 05keeps the sessioncookies and headers persist across runs of the same hunt
- 06reaches you from a residential addresspinned per hunt, recycled on a ban, so a block is an hour not a stop
Where an unauthenticated scan ends
- the login form
- the Cloudflare interstitial
- the data centre address the target already blocks
- everything behind the account it could not create
Everything it can reach is reachable the way your users reach it. The signing, the evidence and the retest are the same as on any other hunt.
What backs each step →35 findings on 13 live bug-bounty programs.
Found by the same agents that pentest your web app and API, and validated before they count.
35
13
Aug 2026
Incorrect Authorization
Superhuman (formerly Grammarly) · Aug 28, 2026
- RHE-002criticalEXNESS
- RHE-035hightoom Baumarkt GmbH - Webshop
A signed report. Every finding carries its exploit.
Scope, method and CVSS-scored findings in one signed PDF. Each finding has its proof of concept and the raw request and response, and it is retested once your fix is live.
Built to run against production.
Testing touches only the hosts in your signed scope, at the request rate written into it, with the test accounts you provide. Nothing destructive or data-changing runs unless you approve it in writing, and a pause in your portal stops testing immediately.
How the pentest runs →Sample data: requests per second over the last 24 minutes, one ridge per minute, newest in front. Testing runs at the rate written into the signed scope, here 1 request per second, and never goes over it.
- Hosts
- Only the ones you sign
- Pause
- From your portal
Published prices, flat per surface.
Starter is one full pentest a month. Growth and above run a pentest after every release you approve, and more releases do not change the price.
€99/ mo
One app, one full pentest a month, validated findings at a flat price.
€499/ mo
Continuous penetration testing on one production surface, at a flat price.
€999/ mo
Two surfaces, running at once. Priority scheduling.
If the pentest finds no validated High or Critical issue in scope, you get that billing period's fee back.
Compare all plansEvidence for the controls your auditor reads.
Rheono tests and signs. cSquare GRC maps the report to your SOC 2 / ISO 27001 / NIS2 / DORA controls and tracks the fixes. Your auditor decides. Neither of us audits or certifies you.
- SOC 2AICPA TSC
- CC4.1
- Monitoring activities
- CC7.1
- System operations
- ISO 27001Annex A
- 8.8
- Management of technical vulnerabilities
- 8.29
- Security testing in development and acceptance
- 8.34
- Protection of information systems during audit testing
- NIS2Directive (EU) 2022/2555
- Art. 21(2)(e)
- Development and maintenance
- Art. 21(2)(f)
- Effectiveness
An annual pentest, a scanner, or Rheono.
annual / per-test pentest
- cadence
- once a year or per engagement
- what it proves
- depth on one day, then ages
- cost
- €5k–25k per engagement
- the evidence
- a PDF that tests yesterday's app
scanner / alert feed
- cadence
- continuous, unattended
- what it proves
- possible issues (assumed)
- cost
- per seat or per asset
- the evidence
- a dashboard of unverified noise
Rheono · ours
- cadence
- monthly on Starter · after each release on Growth
- what it proves
- validated exploit + PoC
- cost
- €99/mo one pentest · €499/mo after every release
- the evidence
- signed report with NIS2 / ISO 27001 mapping
When Rheono is the wrong choice
- You need a one-shot engagement with a named methodology date for a contract clause. That is a separate manual letter, not this subscription.
- You need internal networks, mobile binaries, or social engineering. Rheono pentests the external web apps and APIs you authorize.
- You want 24/7 MDR-style monitoring. Rheono runs a pentest after each release and files a signed report.
- You only want a vulnerability scanner dashboard. Rheono sits next to one and sends only findings with a working exploit.
Questions buyers ask first.
Full FAQ →- Proof, or another alert dump?
- Every reported finding passes three checks. An engineer agent proves the exploit, a validator agent in a separate session tries to break that proof, and where the bug class allows, a script replays it with no agent involved. A signal without proof is dropped before it reaches you. How each check works.
- How fast does a finding reach us?
- Criticals reach you within 24 hours of verification, on the channel you named in the scope. Everything else arrives in the signed report.
- Which accounts do the agents use?
- Only the test accounts you provide, for the roles you list in the scope. The agents log in with nothing else.
- What counts as one surface?
- One web app and the API it calls, on the hosts you list in the signed scope. Pro covers up to three surfaces.
- What does the free check touch?
- Read-only HTTP to your public site at a capped rate of about one request per second, with no logins, no test payloads and no port scans. Nothing on your systems changes. Or skip it and start a plan.
See what an attacker sees on your site.
Send your domain and confirm you may authorize testing on it. The check is read-only, the written report arrives within one business day, and it is yours whether or not you buy.
Start my free check