Enter your domain, confirm the scope from an address on it, then book your findings review — that booking is what starts the assessment. A Privaxi analyst validates every finding and walks it with you live. The written report and remediation are what you pay for — the findings are yours free.
How the free test runs
Five things are true before a single packet leaves our infrastructure — and they stay true for the whole window.
Registrant records, netblock ownership, and a confirmation link to an address on your own domain. If the assets are not yours, nothing runs.
Exact scope, the testing window, and the source addresses our agent tests from — so your team can allowlist or monitor us while we work.
No denial of service, no destructive payloads, no social engineering of your staff, and no data pulled beyond what proves access.
An emergency contact is on your confirmation email. We halt testing within 15 minutes of a stop request, no questions asked.
Signer, title, timestamp, source address and the full scope hash are retained in append-only storage for both of our protection.
Redacted, from real assessments
Every finding is validated before it reaches you. If we say something is exploitable, we exploited it.
A virtualization console on a non-standard port with default credentials unchanged — full host control from an unauthenticated session.
A subdomain nobody remembered provisioning, running an old build with a database socket bound to the public interface.
Employee addresses found in third-party breach dumps, with password reuse confirmed against the VPN portal and MFA not enforced on that path.
Findings mapped to the frameworks your auditors ask about
After the free test
Priced by the IPs you actually expose — published, not quoted. Less than a single annual AI pentest, and anything you spend on a one-off evaluation is credited against your first month.
Single target
A single domain, fully assessed with the written report included. No subscription — the cleanest way to put one host in front of an auditor.
Recommended: Essential
Covers up to 10 IPs — from $49.90 per IP, per month
$499/month
1–10 target IPs
$499 /month
$4,990/year billed annually
From $49.90 per IP, per month
Automated testing
11–25 target IPs
$999 /month
$9,990/year billed annually
From $39.96 per IP, per month
Analyst-reviewed
26–50 target IPs
$1,599 /month
$15,990/year billed annually
From $31.98 per IP, per month
Human validation
51–100 target IPs
$2,999 /month
$29,990/year billed annually
From $29.99 per IP, per month
Full programme
Anything above 100 IPs is priced custom. Larger estates, multi-site networks and regulated infrastructure get scoped individually — depth, cadence and terms set against your environment rather than a band.
Every plan reports as audit evidence. Each test produces a signed PDF mapped to the control your framework tests you against — the same document your auditor asks for.
You get a clean external result and a list of everything we tried, free. That is useful evidence for an auditor or an insurer, and a strong argument for testing the inside instead.
No denial of service, ever. Testing is rate-limited, the window is yours to set, and one reply halts it inside 15 minutes.
Start anyway. At the authorization step you can forward a pre-filled rules-of-engagement request to whoever can, and you stay on the thread.
Nothing is pulled beyond what proves access. Evidence is retained for your report and destroyed on request. Your findings are never shared or resold.
