Rheono vs Armadin: a price and a checkout, or a funded platform with people on the console

Verdict

Rheono wins when you want to read the price, start without a procurement cycle, and pay per surface. Armadin wins on brand, seniority of the operator, and its depth beyond the web app. Starter is €99 a month, €499 for continuous.

What Armadin is

Armadin is the product of Mandia, launched in late October 2026 with $190M behind it. It sells what it calls agentic pentesting: an AI agent runs the engagement while a human operator directs, and the customer watches the session live and chats with the operator during the test.

It claims 200 or more vulnerability classes, 50 or more attack techniques, and detection coverage mapped to MITRE ATT&CK, OWASP Top 10 and OWASP API Top 10. It advertises a workspace with live console, reports it calls certificate-grade (a format, not a certification), analyst notes and validated findings with CVSS.

Scope is web apps, APIs, internal and external networks, and cloud configurations, backed by human operators. Entry is a booked call and the price is not published.

What Armadin does better

A person on the console. An operator directs each engagement and answers in the live chat while it runs. At Rheono the operator is the customer: the fleet runs, the record is its own, and a human is only pulled in for a hard second factor.

Reach beyond the external app. Networks, cloud configuration and internal scope are covered. Rheono tests external web apps and APIs.

Report presentation is packaged: a format, not a certification. Rheono's report is built for an auditor to read and carries reproductions; whether it becomes evidence is the customer's auditor's call.

Brand and capital. $190M and a founding team with a public track record reassure a buyer who needs a name to point at. Rheono is a single founder and says so.

Where Rheono differs

The price is on the page. Armadin does not publish one; the entry is a call. Rheono publishes a flat price per surface and takes checkout without a conversation.

The agent is not watched. Armadin's human operator is the product feature. Rheono's agents work unattended; a run does not need a person to sit through it, which is what makes a nightly cadence affordable, and the price does not move with how long an agent works.

Proof graded outside the vendor. Rheono's findings land on public bug-bounty programs under a stranger's triage. That is a score no vendor controls, which a funded competitor's own benchmarks cannot replicate by writing more of them.

Scope in writing before the first request. You prove you own the domain with a DNS TXT record or a well-known file, then sign an authorization with rules of engagement: hosts, techniques, rate limits, no-gos and a contact. It is valid for 90 days, and the agents only talk to the hosts it names.

Three checks behind every finding. The agent that finds a flaw proves it once. A separate validator, which never saw that work, tries to break the proof in its own session, and a scripted replay reruns the exploit where the bug class allows. The signatory reviews the result and signs the report with an advanced electronic signature, with NIS2 / ISO 27001-ready evidence mapping. The sample report shows one finding end to end.

A European vendor. Rheono is run from Germany, stores customer data in the EU, signs a DPA under Art. 28 GDPR and bills in euros.