Rheono vs Enclave: agent pentests at a flat price, or a security agent team on a usage quota

Verdict

Rheono wins when you want agents to pentest one web app and its API inside a written scope, for a monthly price that does not depend on usage: €99 for one full pentest a month, €499 for continuous coverage.

What Enclave is

Enclave sells what it calls an autonomous security team: a fleet of agents that finish scoped security jobs for AI-native companies. Its homepage lists continuous penetration testing of web apps and APIs, security review of pull requests and code, cloud configuration review, checks on whether a vulnerable dependency is reachable in production, CVE monitoring, and remediation that retests a fix after it deploys. Enclave is backed by 8VC.

Enclave's pricing has three plans. Pro is $100 a month with a monthly usage quota you can top up, plus a 7-day free trial. Team is $500 a month with a larger quota shared across the team, unlimited teammates, roles, an audit log and a Slack integration. Enterprise is custom and adds a forward deployed security engineer and self-hosting. The page does not say how large each quota is.

What Enclave does better

More kinds of security work. Enclave's agents also review pull requests and code, check cloud configuration and track which vulnerable dependencies are reachable. Rheono's agents pentest web apps and APIs; a code-assisted add-on reads release diffs, and per-PR review is still in development.

Built around a whole team. The Team plan has unlimited teammates, roles and permissions and an audit log, and Enterprise can run self-hosted. Rheono is sold per surface.

Fixes as part of the job. Enclave lists remediation among its agents' work, with a retest after the fix deploys. Rheono retests after you fix; delivering the fix as a pull request is in development.

Where Rheono differs

No quota to watch. Enclave's plans carry a monthly usage quota that you top up when it runs out. Rheono sells coverage of a surface: Starter is one full pentest a month for €99, and on Growth, at €499, a pentest runs after each release you approve, with light monitoring between them. More pentests do not raise the bill, and there is nothing to top up.

Scope in writing. Before anything runs, you prove domain ownership with a DNS TXT record or a well-known file and sign rules of engagement: hosts, techniques, rate limits, no-gos and a contact. The authorization lasts 90 days, and the agents only talk to the hosts it names.

Three checks and a signature. The agent proves the exploit, a separate validator tries to break the proof in its own session, and a scripted replay reruns it where the bug class allows. The report is signed with an advanced electronic signature and carries NIS2 / ISO 27001-ready evidence mapping. The sample report shows one finding end to end.

European by default. Rheono is run from Germany, stores customer data in the EU and prices in euros.