Rheono vs MindFort: flat per surface, or credits that scale with depth

Verdict

Rheono wins when you want one published price per surface and want the tests run against the live app from outside, without a repo. MindFort wins when you want the fix written for you and can live with metered credits. €99 a month is one full pentest; €499 is continuous.

What MindFort is

MindFort sells agent swarms that attack a live application, prove each finding with a working exploit, open a patch pull request, and retest after the fix. It states a false-positive rate below 1% and a time to verified findings under 8 hours, and it says source code is optional.

Its pricing is published and metered. Starter starts at $499 a month with 250 credits and one concurrent assessment; Scale starts at $999 with 800 credits and five. Depth costs credits: 200 for a balanced run, 400 deep, 800 ultra. Retests and patch PRs draw from the same pool, and overage bills at once.

Two claims matter to this comparison. Agents complete authenticator-app, SMS and email MFA themselves, and dual-credential mode stores two accounts to test cross-tenant access. Its FAQ states the only human decision is merging the fix.

What MindFort does better

MFA without a human. MindFort's agents complete TOTP, SMS and email MFA on their own. At Rheono, email verification is agent-handled and hard second factors still raise a takeover request for a person.

The fix, written. MindFort opens a patch pull request and retests after deployment. Rheono reports and retests; it does not write the patch.

A published false-positive number. MindFort states under 1%. Rheono scores false positives in its eval harness, but does not publish a live rate yet.

More targets per plan. Scale carries unlimited targets for $999. Rheono's Growth covers a single surface.

Where Rheono differs

Cost does not rise with depth. MindFort meters: a deep run costs 400 credits and an ultra run 800, and both retests and patches spend from the same pool. Rheono's price is flat per surface, and depth is not a meter. A month of daily deep runs on Growth costs the same as one.

No repo needed, ever. Source is optional at MindFort but the patch PR needs a repo. Rheono's pentest never needs one at all.

Scope in writing before the first request. You prove you own the domain with a DNS TXT record or a well-known file, then sign an authorization with rules of engagement: hosts, techniques, rate limits, no-gos and a contact. It is valid for 90 days, and the agents only talk to the hosts it names.

Three checks behind every finding. The agent that finds a flaw proves it once. A separate validator, which never saw that work, tries to break the proof in its own session, and a scripted replay reruns the exploit where the bug class allows. The signatory reviews the result and signs the report with an advanced electronic signature, with NIS2 / ISO 27001-ready evidence mapping. The sample report shows one finding end to end.

A European vendor. Rheono is run from Germany, stores customer data in the EU, signs a DPA under Art. 28 GDPR and bills in euros.