Continuous penetration testing for your web app and API
AI agents test only the hosts you authorize in writing, and every finding comes with a working exploit. Starter runs one full pentest a month. Growth and above test again after every release you approve.
Sample path: api.acme.example → /v1/orders → another customer's orders. HIGH, 3/3 checks.
- Every finding
- A working exploit
- Before it ships
- Three checks
- The report
- Signed, CVSS-scored
- Control
- Pause any time
Evidence mapping for SOC 2, ISO 27001 and NIS2 is included, not certified. Nobody here certifies you: your auditor decides.
Four steps, every one in writing.
- 01Scope
You sign the scope before anything runs.
Domains, API paths, roles, the rate limit, test windows and an emergency channel, all in writing before the first request. A host that is not listed is never touched.
Rules of engagementsample · acme.example- Hosts in scope
- shop.acme.example · api.acme.example
- API
- /v1/* · OpenAPI spec attached
- Roles
- admin · staff · customer, with your test accounts
- Rate limit
- 1 request / second
- Data-changing tests
- Off unless approved in writing
- Emergency stop
- Portal pause · emergency channel
- 02Map
Agents map what an attacker can reach.
Subdomains, endpoints and login flows on the hosts in scope, and nothing outside them. On Growth and above the map is refreshed between the releases you approve.
Attack surfacesample · acme.exampleSample data, acme.example. Agents map the 16 endpoints on shop and api, the two hosts in scope; height = roles that can reach an endpoint (anonymous, customer, admin). mail, vpn, status and intranet lie flat outside the scope fence, never touched.
- 03Exploit
A lead plans. Engineers exploit. A validator checks.
The lead agent stays off the target and hands out one slice at a time: access control, authentication, business logic. Engineer agents come back with a working exploit, and a validator agent tries to break it before it counts.
Exploit + validatesample · acme.exampleSample data, acme.example. Agents test the mapped endpoints one by one; height = roles that can reach an endpoint. /v1/orders on api.acme.example fills red and grows a level: one customer reaches another customer's orders. HIGH, IDOR, 3/3 checks.
Three checks before a finding counts.
Verdict gatesample · fictitious dataRHE-2026-041IDOR · api.acme.example/v1/orders
- 01FoundEngineer agentExploit
Sequential order IDs. 41 other customers' orders read.
- 02ChallengedValidator agentHolds
Tried to break the proof. It still reads foreign orders.
- 03ReplayedReplay scriptMatch
Same request, same response, both captured.
Ruling3/3
All three agree. Finding ships.
SignedOne check fails and the finding is dropped before it reaches you. That is how false positives stay out of the report.
How each check works →- 01FoundEngineer agentExploit
- 04Report
A signed report, then a retest of every fix.
Criticals reach you within 24 hours of verification on the channel you named. The report gives every finding a CVSS score, its proof of concept and the attack path, with evidence mapping for SOC 2, ISO 27001 and NIS2. When your fix is live, it is retested.
HIGH · finding confirmed#3 · as of 14:04:51 UTC · sampleIDOR: another customer's orders
api.acme.example/v1/orders
- CVSS
- 8.1
- Checks
- 3/3
Open the sample report →Signed reportwhat every report carries- Executive summary: scope, method, findings, business risk
- Every finding with CVSS, proof of concept and the attack path
- Raw request and response, and checksums for the evidence
- Evidence mapping for SOC 2, ISO 27001 and NIS2
- Remediation at the root, then a retest when the fix is live
You stay in control of every test.
Rate-limited and non-destructive by default: no denial of service and no data-changing attacks unless you approve them in writing. Logins only with the test accounts you provide. Pause from your portal, or use the emergency channel in your rules of engagement, and testing stops.
Testing · 0.8 req/sPaused · 0 requests
Testing runs inside the scope you signed, under the rate cap.
- Data-changing tests
- Off unless approved
- Stop
- Portal pause, immediate
What a pentest covers.
From your public hosts to the data that matters, inside the scope you signed.
Tested
- Web apps and APIs on the hosts in scope: subdomains, endpoints, login flows
- Authentication and authorization, with the test accounts you provide
- Business logic: IDOR, race conditions, payment and checkout flows
- Access to other users' data, proven read-only
- Privilege escalation within the agreed scope
- Injection where input is passed on, such as SQL injection and SSRF
Not tested
- Denial of service or load testing, unless you approve it in writing
- Destructive or data-changing attacks, unless you approve them in writing
- Hosts you did not authorize, and third-party services they call
- Internal networks, mobile binaries, social engineering and physical access
From finding to verified fix.
- 01During the pentest
- Criticals within 24 hours of verification, on the agreed channel
- Every alert with a working proof of concept, not just a flag
- The same channel for your questions while the pentest runs
- 02On delivery
- The signed report, PAdES-B-T with an RFC 3161 timestamp
- NIS2 / ISO 27001-ready evidence mapping, at no extra cost
- Prioritized remediation at the root, not the symptom
- 03After the fix
- A review of your fix before you ship it
- A retest as soon as the fix is live
- On Growth and above: a pentest after every release you approve
35 validated findings on 13 live bug-bounty programs since Aug 2026, found by the same agents.
Read the research →Flat per surface, from €99 a month. No validated High or Critical in scope: that period's fee back.
See plans and prices →Rheono tests and signs the report, cSquare GRC maps it to your controls, and your auditor decides.
From report to audit evidence →
First,a read-only check.
Send your domain and confirm you may authorize testing on it. The check is read-only and takes about 20 minutes, nothing changes on your systems, and the written report arrives within one business day. It is yours whether or not you buy.