Pentest, not just a scan
See which findings can actually be used, so your team spends less time on noise.
AI pentesting for websites, web apps and APIs
Pentesting that doesn’t stop at one report.
Pentcycle finds vulnerabilities and CVEs, tests whether attackers could actually use them, and checks again after you fix them. Every week, for less than the average manual pentest.
demo.example.comVerified
Findings3
Test runs
Retests
Reports
Authorization
Test settings
Account
Findings
Cycle 12 result
Finished Nov 3, 8 findings
Critical
1
High
2
Medium
2
Low
2
Info
1
Open findings
3
Exploit confirmed
2
Fixed this cycle
4
Next test
Mon
All (8)
Open (3)
Exploit confirmed (2)
Fixed (4)
Dismissed (0)
Search findings
CVSSFindingStatus
9.1Critical
SQL injection/api/orders
Exploit confirmed
7.7High
Access to another customer’s invoice/api/invoices/:id
Exploit confirmed
6.1Medium
Outdated library with a known CVE/static/app.js
Needs review
SQL injection
/api/orders
Exploit confirmed
A yearly test leaves a long gap.
43 days
Median time to fix known exploited vulnerabilities, up from 32 a year earlier.
Verizon DBIR 2026How it works
One cycle, repeated every week.
-
01
Authorize
Add your domain and sign a written authorization. We test only what you approve.
-
02
Test
AI finds vulnerabilities and CVEs, then pentests them to see which can really be used.
-
03
Fix
The panel shows what to fix first, so your developers start with what matters most.
-
04
Recheck
Pentcycle tests again and shows whether the issue is closed. Then the next cycle begins.
Features
From first finding to confirmed fix.
One panel for priorities
Severity, status and next step for every site, web app and API.
Automatic rechecks
Know whether a fix worked without booking another engagement.
Reports people ask for
Share results with customers, auditors and insurers when they ask for them.
For teams shipping faster than they can test.
Startups using AI to code
Check every week what moved too fast for a security review.
B2B SaaS facing security reviews
Answer customers, auditors and insurers with current results.
Hosting providers and web studios
Offer security audits to your own customers on a partner plan.
Pricing
Simple annual plans.
Start
For startups and small SaaS
$2,990 / year
or $299 billed monthly
- AI pentest every week
- One site, web app or API
- Panel with priorities
- Automatic rechecks and report
Compliance
For B2B SaaS facing security reviews
$12,000 / year
Annual contract
- Everything in Start
- Report signed by a qualified specialist
- New signed report after significant changes
Partner
For hosting providers, MSPs and web studios
$24,000 / year
Includes 100 sites
- AI pentest every month for each site
- One panel for all client sites
- You set the price for your clients
Early access pricing. SOC 2 audit fees are paid separately to your CPA firm.
Clear about the limits.
Not a SOC 2 report
Only a licensed CPA firm can issue one. We provide testing results you can use in the audit.
Not enough alone for PCI DSS
PCI DSS also requires manual testing by a qualified tester.
Focused on the web
We test websites, web apps and APIs, not internal networks or devices.
Not a guarantee
No test finds everything. We show what was tested, what was found and what changed.
Questions
What does written authorization mean?
The site owner confirms in writing which assets we may test. Without it, we do not run a test.
Could testing affect my site?
Scope and timing are agreed before testing starts.
Will my auditor accept the report?
That depends on your auditor and framework, so ask them first. Some ask for a named specialist's review, which is why the Compliance plan includes a signed report.
How often do tests run?
Every week on Start and Compliance, and every month for each site on Partner.
Can I pay monthly?
Yes, on Start for $299 a month. Compliance and Partner are annual contracts.
Start your first cycle.
Leave your work email and we will contact you about early access.