Rheono vs Hacktron: a pentest without source access, or a white-box pentest from your code

Verdict

Rheono wins when you want the running web app and its API attacked from outside, the way an attacker sees them, at a flat monthly price per surface and without handing over source code: €99 for one full pentest a month, €499 for continuous coverage.

What Hacktron is

Hacktron sells three AI security products. Hacktron Review reads every pull request with full-codebase context and validates findings for exploitability before reporting them. Hacktron Whitebox is a white-box penetration test of a defined application. Hacktron Red is continuous red teaming for the whole organisation, from exposed domains and APIs to identity providers, SaaS providers and the supply chain, with researchers directing the agents.

The Whitebox pentest starts from source access: you define the repositories, services and user flows in scope. Hacktron says it is built for web, mobile, backend, API, CLI and native codebases, that security researchers validate the findings, and that most teams get a report within 5 days, with an attestation letter on request. Its documentation adds that a pentest also uses target URLs and access instructions, shows its dynamic testing actions, runs on shared organization credits, and includes one free retest per scan.

Hacktron's pricing section publishes one price: a Pro plan from $40 per developer a month, with 50 pull requests per developer and $1 for each additional one. Enterprise is custom, and the Whitebox pentest has no published price. There is a 14-day free trial without a credit card, and the PR review bot is free for qualifying open source projects.

What Hacktron does better

Security inside code review. Hacktron Review checks every pull request in GitHub, GitLab, Bitbucket or Azure DevOps and reports the findings it has validated, before the change ships. Rheono's code-assisted add-on reads each release diff, and per-PR review is still in development.

Reach beyond one app. Hacktron Red tests an organisation's exposed domains, identity setup, SaaS providers and supply chain. Rheono tests external web apps and APIs you authorize, priced per surface.

Codebases Rheono does not test. The Whitebox pentest covers mobile, CLI and native code as well as web and API code. Rheono's scope is external web apps and APIs, and mobile binaries are out of it.

Where Rheono differs

No source code needed. Rheono's agents work on the running web app and API from outside, with the test accounts you provide, which is the view an attacker has. A finding counts only when the exploit works against the live system. Hacktron's Whitebox pentest starts from source access. With repo access, a code-assisted add-on reads each release diff for data-flow and auth issues, as a flat add-on agreed in writing.

One flat price per surface. Starter is €99 a month for one full pentest a month on one web app and its API. Growth, at €499 a month, runs a pentest after each release you approve, with light monitoring between releases, and more pentests do not raise the bill. Hacktron's Pro plan is priced per developer, with $1 for each pull request beyond 50 per developer, and its Whitebox pentests run on credits whose price is not published.

Scope in writing before the first request. You prove you own the domain with a DNS TXT record or a well-known file, then sign an authorization with rules of engagement: hosts, techniques, rate limits, no-gos and a contact. It is valid for 90 days, and the agents only talk to the hosts it names.

Three checks behind every finding. The agent that finds a flaw proves it once. A separate validator, which never saw that work, tries to break the proof in its own session, and a scripted replay reruns the exploit where the bug class allows. The signatory reviews the result and signs the report with an advanced electronic signature, with NIS2 / ISO 27001-ready evidence mapping. The sample report shows one finding end to end.

A European vendor. Rheono is run from Germany, stores customer data in the EU, signs a DPA under Art. 28 GDPR and bills in euros.