every release
retested after you ship, no per-scan billing
100% PoC
every finding with a working PoC
NIS2 · ISO 27001
signed report + evidence mapping, included, not certified
Startups from pre-revenue to Series A that ship monthly+ and need current, signed evidence for the first enterprise questionnaire, a SOC 2, or a diligence round; the standing hunt is your external CISO on a flat fee. Teams that changed little but got their customer's NIS2 questionnaire start with the one-off audit and add continuous coverage later. When the report is asked for, you hand over one that is days old, not months.
01
Hosts, app, API, auth roles: the exact scope sits in a signed authorization and rules of engagement, before the first probe. What isn't in it is never touched.
This is your authorization: what the hunt may touch. What isn't listed is never touched.
02
From the outside, the agent fleet maps every host and endpoint, around the clock, without flooding your logs. What changes is known before an attacker uses it.
runs 24/7 — changes are noticed
This is what attackers could see from outside. The fleet maps it continuously, before anyone else uses it.
03
The hunt flags a signal. Every finding is proven with a working PoC and validated by a named researcher before it lands. Unproven, not reported.
No alarm without proof: every finding ships with a working PoC, and is checked by a named researcher.
04
CVSS plus NIS2 / ISO 27001 mapping, signed, prioritized at the root. Every release is retested; the retest is the default, not an extra.
Retestrelease 2.41 → fix verified ✓
A standing document with a signature: the one you hand to an auditor. Retested after every release.
A named researcher makes the calls. The agent fleet maps, follows paths, correlates. Nothing reaches your report that a human has not executed himself.
We work like a real attacker: from the outside, on your authorized surface. We report only what we can prove.
We test for
We map your authorized internet-facing surface and exploit what we find to establish a real foothold.
We assess
From the foothold we test how far an attacker gets: to the assets that actually matter to you.
One report or the standing hunt. Flat prices, in writing, no per-scan billing.
Your external CISO on one flat annual fee: every release retested, the report stays current. The fee does not grow with your release count.
A deep snapshot of your web app and API in 3–5 days: signed NIS2 / ISO 27001 report, PoC per finding, one retest included.
Repo access: every release diff read for data-flow issues. File:line + PoC, not scanner output.
The signed report as a compliance artifact: PAdES-B-T + qualified timestamp, evidence mapping. No extra cost.
This pipeline hunts live bug-bounty programs every day; your hunt runs on the same one. Full report list on request.
Order ID comes from the client, no ownership check on reads.
Tokens minted from a counter, not a CSPRNG.
No rate limit or lockout on the auth endpoint.
Full report list on request.
from
€99/ month
Starter · one deep hunt/month. Continuous Growth from €499/month. Annual ~20% off.
Published tiers on /pricing: Starter €99/mo, Growth €499/mo, Pro €999/mo, Business €2,499/mo. Enterprise custom. Free check first.
What the market charges right now: 2026 ranges by type, hidden costs, the flat comparison.Flat and predictable. No per-scan billing, ever. Annual by default, monthly also available; both in writing before we start.
No validated High or Critical in the agreed scope, you don't pay. CVSS-scored, human-validated, in the signed report.
Agreed scope, signed report, CVSS scale. In writing in the contract.The test, the price, code access, your data — every question answered in writing, every answer with the next step.
Send us your domain. A researcher confirms your request, the check takes about 20 minutes (read-only, nothing reaches your systems), and then you have the short written report: what an attacker can realistically do with it. Yours whether or not anything follows. If we keep hunting: one flat annual fee, in writing.