Who can see what
A user sees another user's data by changing a number in the address. A scanner does not know what "another user" means.
penetration testing with artificial intelligence
Penetration testing and vulnerability assessment, verified by people
We test web applications, APIs, mobile apps, cloud and infrastructure with AI-assisted analysis, inside a scope you have authorised in writing. Whoever commissions the test receives evidence for every vulnerability, and no report leaves without review.
Scope locked to the verified domain
Every action logged
Human review before the report
penetration testing and vulnerability assessment
Two different services, both verified by people.
A vulnerability assessment finds and ranks the vulnerabilities of applications, APIs and infrastructure: it produces a prioritised inventory. A penetration test goes further and proves that a vulnerability can be exploited, and with what impact. ExploitFinder performs both, with AI-assisted analysis and a final review by people.
Results are verified by people before they enter the report: the vulnerability assessment does not stop at a scanner-generated list, and the penetration test does not deliver hypotheses, but reproduced vulnerabilities with severity and a fix.
the context
A list of vulnerabilities is not enough when you must prove security.
Your client asks for evidence, not a generic PDF. These are the classes of vulnerability automated tests rarely find. They are hypotheses: the public benchmark will show whether and how far they hold.
Rules that can be bypassed
A discount applied twice, an order paid with a modified amount.
Two low-severity vulnerabilities, one high impact
A minor error and a weak configuration can together give full access.
services
One service for each surface. Each with its own method and price.
An OWASP test, an API test and an access test are not done the same way and do not cost the same. Each service has its own sheet.
OWASP Top 10 testing
The most common risk categories in web applications.
API testing
Object-level authorisation, authentication, exposed data.
Mobile app testing
Package analysis and tests on a test device.
Cloud review
Identity, permissions, storage and logging on AWS, Azure and Google Cloud.
Infrastructure testing
Exposed services, versions, TLS and segmentation, external and internal.
Access and business logic
Who can do what across roles, users and steps of a flow.
how it works
Four steps. Every step has a control.
Scope
Domain, test roles and time window, written and signed.
Verification
A DNS check of the domain. Without verification, no test runs.
Analysis
Recon, plan, controlled tests and attack chains. Every action goes into the log.
Review
A person checks every finding. Only then is the report prepared.
the platform
It starts from the authorised scope.
Every test begins by naming the target, which must fall within an authorised scope. You can set a priority (IDOR/BOLA, SSRF, RCE), add instructions and, if needed, provide authentication.
Verified on evidence, not on lists
- Findings with evidence: each one shows its severity and whether it is backed by evidence or still a hypothesis.
- Analysis history: scans, status and severity over time, from a single dashboard.
- Verified by people: no finding reaches the report without human review.
sample report
See a real report before you commission one.
A 69-page report generated by the ExploitFinder engine on a public, deliberately vulnerable test application (testphp.vulnweb.com). It shows the structure, level of detail and traceability of a complete report.
Management summary
Overall risk, methodology and results on a page that non-technical readers can follow.
Evidence and reproduction
An evidence register and technical sheets for each vulnerability, with the steps to repeat it.
Remediation plan
Fix tracking, residual risk and a risk acceptance declaration.
Download the sample report (PDF, 69 pages)
Note. The target is a public test application, not a client. The report is in English and was produced by the automated engine; reports delivered to clients go through the human review described on the How it works page.
an example
A test, step by step.
This is how a cross-role access check looks: every line is a recorded step, and the last one waits for a person.
$ exploitfinder run --service access-logic --scope app.client.com
[ok] domain verified through DNS
[ok] authorisation signed, valid until 10 November
[ok] scope locked to app.client.com
[..] recon: 12 endpoints, 3 roles
[..] plan: cross-role access checks
[!!] possible access to another user's data
[ ] waiting for human review
Illustrative example. Not a real result.
what the AI automates
The AI proposes. A person decides.
The AI does
- Map the surface of the verified domain
- Propose test hypotheses and run them within the agreed limits
- Link findings into attack chains
- Prepare the first draft of the report
The AI does not
- Test a domain that has not been verified
- Go outside the signed scope
- Decide the severity of a vulnerability on their own
- Send anything to the client
who it is for
For teams that build applications and must prove their security.
Software houses and agencies
You deliver applications to SMEs or public bodies, and they ask for a security proof for a tender or a renewal.
Compliance consultants and DPOs
You resell the proof to your clients, with the same signed scope and the same log.
compliance
Tests required by standards, with the evidence an auditor needs.
We produce the evidence. The judgement stays with whoever certifies or audits.
SOC 2
Evidence of control monitoring and vulnerability detection.
PCI DSS
Penetration testing for requirement 11.4.
ISO 27001
Vulnerability management and security testing.
GDPR
Regular testing of technical measures, Article 32.
NIS2
Vulnerability handling and verification of effectiveness.
how to start
Three steps, from the quote to the full service.
Quote in 24 hours
You give us the domain and the reason: certification, client or tender. Within 24 working hours you receive in writing the scope, method, timing and price.
Comparison pilot
One verified application, compared with the scanner you already use. The €490 is deducted from the first service you buy within 60 days.
Full service
Testing with a signed scope, human review and a report with reproducible evidence for every vulnerability.
questions
Frequently asked questions.
How much does a penetration test cost?
It depends on the service: from €1,000 to €7,500, indicative and confirmed in the written proposal. The first step is a written quote within 24 working hours, with no obligation. Prices by service are on the Pricing page.
Can the test take my service down?
We do not run denial-of-service tests. The time window, hosts and prohibitions are written into the signed scope before the start, and one command halts active tests immediately.
How is it different from a vulnerability scanner?
A scanner compares the system with known signatures. We use one, and we also check access between roles, business logic and attack chains, which signatures do not see. A person reproduces every result.
What do I get at the end?
A report that technical staff and management can read, with reproduction steps, severity and a fix for every vulnerability, the action log and, when an auditor needs it, a scope letter.
Do I need an authorisation?
Yes. Before any test you sign a declaration that the domain is yours or that you have the right to test it. Without a signature, the test does not start.
What happens if the test finds a serious vulnerability?
The system reports it immediately and suspends that line of testing, which resumes only after a person confirms.
Where is my client's data processed?
The contract states where data is processed and with which model. For clients with data constraints, an option with a model in the European Union or running locally is planned.
How long does a test take?
It depends on the service and the scope. The duration is written in the proposal, before work starts.
Start from a domain you can prove you control.
We reply by hand within 24 working hours, with a written proposal or a clear reason.