Rheono vs AvalonX: a price you can read, or a demo you have to book

Verdict

Rheono wins when you want to start today at a published price without a call: €99 a month for one full pentest, €499 for continuous. AvalonX wins on price floor and on the fix-adjacent extras around testing.

What AvalonX is

AvalonX launched in late October 2026 selling continuous, AI-powered offensive security on a subscription. Plans start at $249 a month. Its agents run on Aether, a 400 billion parameter model it says it trained on nine years of offensive-security data and 60 billion dark-web records.

It markets a same-day turnaround, always-on testing, on-demand runs, and human testers verifying what the agents find before a customer sees it. It also maps findings to SOC 2, ISO 27001, PCI DSS and HIPAA, and issues a public AAA mark that records when a customer was last tested and what was in scope, explicitly not a certification.

Scope covers domains, IP ranges, cloud accounts, applications and internal networks. Signup goes through a demo booking, and the model is not available separately: no public API, no licensing.

What AvalonX does better

A lower published floor. $249 a month against continuous coverage at Rheono, a subscription rather than a per-run charge.

Reach beyond the external app. Scope includes IP ranges, cloud accounts and internal networks. Rheono tests external web apps and APIs.

A public mark. The AAA badge links to a live page showing when testing happened and what was covered. Rheono publishes findings publicly instead, and has no customer mark.

Four compliance frameworks are named off the shelf. Rheono maps to NIS2 and ISO 27001 through a GRC partner, and it is the customer's auditor who decides.

Compliance mapping is packaged to four frameworks. Rheono maps to NIS2 and ISO 27001 through a GRC partner, and the customer's auditor still decides.

Where Rheono differs

No demo gate, and the price is on the page. AvalonX's entry is a demo booking. Rheono is self-serve: a free read-only check first, then a flat checkout, both without a call, and billed in the EU.

The model is yours to reach. AvalonX states Aether is exclusive, with no API and no licensing. Rheono runs its own 27B and the next motion is licensing that box to teams who cannot send artifacts to a vendor.

Proof that is public and graded by strangers. Rheono's findings land on a public board under live bug-bounty programs, so a reader scores the engine without trusting either vendor. AvalonX's record is its own benchmark and its own mark.

Scope in writing before the first request. You prove you own the domain with a DNS TXT record or a well-known file, then sign an authorization with rules of engagement: hosts, techniques, rate limits, no-gos and a contact. It is valid for 90 days, and the agents only talk to the hosts it names.

Three checks behind every finding. The agent that finds a flaw proves it once. A separate validator, which never saw that work, tries to break the proof in its own session, and a scripted replay reruns the exploit where the bug class allows. The signatory reviews the result and signs the report with an advanced electronic signature, with NIS2 / ISO 27001-ready evidence mapping. The sample report shows one finding end to end.

Young, and stated as such. AvalonX launched in late October 2026, so neither vendor has a long record on this page's terms; weight the public findings on the advisory board over either pitch.