Continuous pentesting
Blackbox to crystalbox, run against every meaningful change rather than once on a calendar. Findings are re-checked on the next release, so a fix that regresses gets caught the same week.
The core · Assurance and up
Offensive security · EU · AI-augmented, human-signed
We find the way in first
Before someone who means it does. Continuous pentesting and always-on attack-surface monitoring for organisations with something online worth protecting. Testing runs on every release, not once a year — the machine does what is repetitive, a human does what is judgement.
- Your whole codebase read, not a sample
- Every finding reproduced by hand
- Every finding live in your portal the day it is confirmed
Free · no account
See your attack surface
before you talk to us
Give us a domain and we will show you what we can see from the outside — subdomains, exposed services, certificate history — the same first pass we run at the start of an engagement. No account needed.
Not live yet. Want it run by hand in the meantime? Ask us.
How scoping works
A pentest is a box
It has a height, a width and a depth. Height is how much you put in it. Depth is how much of the machinery you let us see. Width — the time — is not something you pick first; it follows from the other two.
Depth — how much we get to see
Height — how much goes in
Painted shut. You give us a domain and permission, nothing more. You learn exactly what a stranger can reach — and the first days go to reconnaissance, because that is the point.
Frosted glass. Credentials for each role and an architecture sketch. Usually the sweet spot: we skip the guessing and spend the time on your authorisation logic instead.
Clear glass. Source, pipelines, cloud config and an engineer to answer questions. Finds the flaws no amount of poking from outside will surface — every hour buys depth rather than discovery.
- Height
- What goes in the box — and what must stay out. Agreed in writing before anything starts.
- Depth
- How much you hand us up front. More access finds more; less access is more realistic.
- Width
- Time. Derived, not chosen — we tell you what the box needs, and what a shorter one costs you.
Included on every engagement · every tier
AI-augmented,
human-signed
Testing every release used to be arithmetic that did not work: a human rereading the same codebase every fortnight is unaffordable, so everyone settled for once a year. Machines are extraordinary at reading all of it and never getting bored, and terrible at knowing which bug matters to your business. Splitting the work along that line is what makes continuous testing possible at a price worth paying — and a human still puts their name on every finding.
What the AI layer does
- Reads every route, handler and IaC file in scope — not the sample a human would have time for.
- Maps the authorisation matrix across roles and flags the combinations nobody documented.
- Drafts and mutates payloads against candidate injection points, then triages the noise.
- Replays the whole finding set against each new build, so a regressed fix gets caught.
- Writes the first draft of the reproduction steps. The tester rewrites what is wrong.
What it never does
- Exploit anything without a named human approving the action against the signed scope.
- Touch production data, or any system outside the agreed rules of engagement.
- Put a finding in your report unverified — every one is reproduced by hand first.
- Reach a model outside the EU without your prior written approval.
- Replace the tester. It buys back the days they would have spent on grep.
On where your data goes. The platform is EU-hosted. Some frontier testing models are not yet available in the EU, so those are opt-in and named in your engagement letter — never a default, never without written approval. By default everything runs in an isolated tenant that is wiped at closeout.
What we do
Testing that keeps up
with your release train
A test once a year describes a codebase that no longer exists. Everything below is built to run continuously instead — and each one is available as a single engagement if that is all you need.
Attack-surface monitoring
Always on. A fresh subdomain, a forgotten port, an expired certificate — surfaced within hours, from several independent sources rather than one feed that keeps falling over.
Included from Perimeter
Single engagements
One pentest, scoped to the euro, no subscription. Blackbox to crystalbox, with the report, the executive summary and a closeout call. Plenty of clients only ever work with us this way.
No subscription needed
Quick retests
You fixed it; we check it. Re-verification on the finding you just closed, without waiting for the next engagement or paying for a fresh one — and the report reissues itself.
Unlimited on every tier
Coordinated disclosure
A published policy, a security.txt, and somewhere reports actually land. We triage what comes in; a real one becomes a finding in your portal like any of ours, retest included, and the researcher hears back from us.
Intake from Perimeter
Threat modelling
The cheapest findings are the ones caught before the code exists. We sit with your architects, map what an attacker would go for, and write it down in a form your backlog can accept.
Per design or per quarter
Credential & dark-web monitoring
Your domains watched across breach dumps and paste sites. A leaked employee password is an unpatched vulnerability that no scanner will ever show you.
Add-on · Assurance and up
Canary tripwires
A credential, a document, a host with no legitimate reason to be touched, planted where an intruder would look. Nothing normal ever trips one — so when it fires you are not triaging a maybe, you are already responding.
Tokens from Assurance · deployed from Adversary
Red & purple teaming
Red: an objective, weeks to reach it quietly, and your defenders are not told — you learn what actually gets noticed. Purple: the same attacks with your team in the room, tuning detection between runs.
Member rate from Adversary · included in Enterprise
The findings portal
Findings arrive as they are confirmed, with reproduction steps, impact in plain language and a fix your engineers can pick up the same day. Comment on them, track the retest, export when you need the PDF.
The deliverable — see one
The deliverable
A finding, the day
we confirm it
Findings land in your portal as they are verified, not in a document at the end. Your engineers argue with us in the thread, the retest is recorded against the same finding, and the report is there to download whenever you need it.
acme-retail — continuous programme
Finding 14 of 31
High
Published
Authorisation bypass on the admin order endpoint
- What it is
- Any authenticated user can read and modify orders belonging to other customers by changing a single identifier in the request path.
- Technical detail
- The handler checks that a session exists but never that the session owns the
order.
GET /api/orders/{id}returns any record;PUTaccepts writes to it. A standard customer account is enough. - Impact
- Every order in the system — names, addresses, contents and totals — is readable by anyone who can register. Order contents can be altered before fulfilment.
- What to do
- Authorise on ownership, not on authentication: resolve the order through the session's customer rather than trusting the identifier. The same pattern appears on three other routes, listed in finding 17.
Discussion
Client · Eng
Is this reachable without an account, or does it need a registered customer?
GetHacked
Registered customer, but registration is open — so the practical barrier is an email address. We have attached the exact request.
Client · Eng
Fixed in 2.4.1, deployed this morning. Can you check it?
Retest
Verified closed · 11 March · report reissued
Illustration of the portal. The target is a reserved example domain and the finding is representative, not a client's.
Annual · billed monthly
Pick your coverage
Every tier includes attack-surface monitoring, the AI layer, the findings portal, unlimited retests on what we raise, and a member rate on single engagements. What changes is how much human testing time sits behind it.
Tier 1 · Watch
Perimeter
Eyes on everything you expose, plus continuous testing on a best-effort basis as capacity allows.
€250Per month · annual
- Continuous attack-surface monitoring
- New-exposure alerts within 24 hours
- Best-effort continuous pentesting
- Unlimited retests on our findings
- Coordinated disclosure: we maintain your security.txt and triage outside reports
- 15% member rate on single engagements
Tier 2 · Recommended
Assurance
Where committed testing time begins — two tester hours every month, spent proactively on what matters most, not best-effort.
€500Per month · annual
- Everything in Perimeter
- Two tester hours every month, spent proactively
- AI-augmented regression replay on every change
- Named point of contact
- Coordinated disclosure, fully handled: outside reports reproduced, filed as findings, researcher handled to closure
- Canary tokens seeded across your estate
- Findings triaged within two working days
Tier 3 · Full stack
Adversary
A tester hour every week, deeper access, and a named tester who learns how you build rather than re-reading your stack each time.
€750Per month · annual
- Everything in Assurance
- One tester hour every week, spent proactively
- Greybox and crystalbox coverage, not just the perimeter
- Named lead tester across the year
- Quarterly review with your engineers
- Canary hosts deployed and tuned to your environment
- Priority scheduling on single engagements
Tier 4 · The organisation
Enterprise
Adversary tests your systems. Enterprise tests your organisation — a team instead of a tester, several products and business units, and a board to report to.
CustomScoped to your org
- Everything in Adversary, across several products, domains and teams
- A dedicated team with a named lead, not a single tester
- A red-team objective every quarter — dates known to a handful of people — with purple sessions after each to tune detection
- Contractual SLAs, your paper or ours, DPA and security questionnaires handled
- Quarterly executive report alongside the portal
All prices exclude VAT. Annual term, billed monthly. One-off onboarding equal to one month's fee. Hours beyond the allowance at €150 per hour, only on your go-ahead. We spend committed hours proactively on what we judge most important; point us at anything specific through the portal. What a tier includes is fixed in a written proposal before anything starts.
Incident response is contracted separately. Not a line in a tier — scope, availability and rate are agreed per organisation, because a promise to pick up during your worst day is not something to buy from a pricing table. Talk to us and we will work out what is actually worth committing to.
Before you ask
The questions
everyone asks
Will testing break production?
It is the first thing we agree and it is written into the rules of engagement. Most continuous work runs against staging or a production-like environment; where we do test production, destructive checks are excluded by name, we agree a window, and you get a phone number that reaches the tester during it. If something does go wrong we stop and tell you immediately.
Who actually does the testing?
A named human, and on the continuous tiers the same one across the year — which is the point. A tester who already knows your stack spends their time on your authorisation logic instead of relearning your architecture every quarter. You will know their name before the engagement starts.
What happens if you find something critical mid-engagement?
You hear about it that day, by phone, before it is written up. Nobody sits on a critical finding until the report is tidy. The write-up follows; the warning does not wait for it.
Where does our data go?
The platform is EU-hosted and each engagement runs in its own isolated tenant, wiped at closeout. Some frontier testing models are not yet available in the EU — those are opt-in, named in your engagement letter, and never a default. If you would rather we use nothing outside the EU, say so and we will not.
What if you do not find anything?
Then you get a report that says so, with the evidence of what was tested and how — which is the thing your customer or auditor actually wants to see. It happens, and it is a good outcome. We will also tell you honestly whether a deeper level of access would have been likely to find more.
How much access should we give you?
More than feels comfortable, usually. Blackbox is the most realistic and the least efficient — you pay for the days we spend discovering what you could have told us in an afternoon. Greybox is the sweet spot for most teams. See the box at the top of this page; it is the same conversation we will have on the call.
Can you start next week?
Often, yes. Scoping is a conversation, not a procurement process, and we schedule around your deadline rather than our quarter. Tell us the date you are working to. If we cannot meet it we will say so on the first call rather than in week three.
We need this for a customer or an auditor. Does that work?
Yes. You get a report, a management summary, and a letter of attestation your customer or auditor can accept — plus the retest, so what you hand over describes the fixed system rather than the broken one.
Next step
Tell us what you have built. We will tell you what it costs.
A pentester reads what you send and is in the conversation from the first reply — not handed in after the contract. You get a written scope and a fixed price within four working days.
- Direct
- security@gethacked.eu
- Company
- LaatJeHacken B.V. · Sleeuwijk, NL
What to send
Roughly what you run and where it lives, what you would like tested, anything that must stay out of scope, and when you need it. That is enough for a written scope — we will come back with the questions that actually change the number.