Pentests in under two weeks. Reports your auditors accept.
Manual-quality penetration testing at automation speed. For SaaS teams prepping for SOC 2, ISO 27001, or enterprise security reviews — without the €20k bill or six-week wait.
You wait six weeks for a junior consultant to run the same scripts you could, then receive a binder padded with informational findings. By the time it lands, half of what they tested has already shipped twice.
Vulnerability scanners stop where the interesting bugs start
Nessus, Qualys and friends flag missing headers and outdated libraries all day. They will not find broken access control, IDORs in your API, or the auth flow your engineer rewrote on Friday afternoon.
Bug bounties without a deadline or a deliverable
Crowdsourced testing is great for breadth, terrible for compliance. There is no scope guarantee, no fixed timeline, and no signed attestation — so you still have to commission a real SOC 2 or ISO 27001 pentest anyway.
Pure-AI scanners that cannot chain an exploit
An LLM can spot a textbook reflected XSS. It cannot pivot through your tenant boundaries, abuse your billing logic, or put a name on the report your auditor needs to see. Without a human in the loop, the output is a demo, not evidence.
Pricing
Clear scope. Transparent pricing. No surprises.
Three tiers built for where you are. Pick one, get a fixed-price proposal in a day, start within the week.
Sprint
One web app or API, delivered in 5 to 7 business days
Read-only repo access on top of dynamic testing. Static analysis catches logic flaws and dead-code vulnerabilities that black-box misses, and shortens the path from finding to fix for your engineers. Available on Sprint and Range.
Compliance mapping+€800
Findings cross-referenced to SOC 2, ISO 27001, GDPR, or PCI DSS controls. We hand your auditor a report that maps cleanly to their checklist, so you skip the back-and-forth and close evidence requests faster. Sprint only — included in Range and Continuous.
Cloud & IAM review+€2,500
AWS, GCP, or Azure configuration and IAM audit on top of the application pentest. Surfaces over-permissive roles, public buckets, and infra misconfigurations your code review can't see. Sprint or Range — included in Continuous.
How it works
From scope intake to a report you can act on in under two weeks.
Six steps, async by default. No discovery call, no procurement gauntlet, and critical findings hit your inbox the moment we confirm them.
01
Free, 2 min
Scoping form
Submit a quick form with your app details, stack, and what the test needs to cover. We send back a fixed-price proposal within 24 hours. No call required.
02
Same day as signed SOW
Kickoff and credential handoff
You hand over test credentials and access. We lock in scope, prepare our testing environment, and agree the rules of engagement.
03
3 to 8 business days
Testing
AI-augmented testing aligned with the PTES framework, signed off by a senior pentester. Every finding ships with a working proof-of-concept, and anything critical is escalated the moment it's confirmed.
04
Within 2 days of testing
Report delivery
An executive summary, technical write-ups with CVSS scores and CWE mappings, per-finding remediation guidance, a full attack narrative, and a signed attestation letter for your auditors.
05
Async
Report walkthrough and Q&A
We share a detailed walkthrough of each finding with remediation steps. Your team raises questions on their schedule; we reply within one business day. Live call on request.
06
Optional, 1 to 2 days
Retest
After fixes ship, we verify they hold. You receive an updated report confirming closure — ready to hand to your auditor.
Why Intruso
AI speed. Senior judgment. Reports auditors actually accept.
Six reasons SaaS teams pick us over consultancies, scanners, and bug bounty platforms when they need a real pentest without losing six weeks of engineering focus.
01
Every finding ships with a working exploit.
No "potential XSS" or theoretical CVSS scores. You get the raw HTTP request, the server's response, and step-by-step repro your engineers can paste into a terminal. If we can't prove it, we don't report it.
CriticalCWE-89SQLi in POST /api/login
HighCWE-639IDOR in GET /accounts/:id
MediumCWE-942Reflected CORS with credentials
LowCWE-1275Cookies missing SameSite
02
Backend-aware playbooks for the stacks you actually use.
Supabase RLS, Firebase rules, WordPress plugins, Strapi roles, GraphQL introspection, REST auth flows, multi-tenant isolation. We carry pre-built attack chains for each — not a generic OWASP checklist run by someone who's never touched your framework.
SupabaseOpenAPI · RPC · Realtime
FirebaseRTDB · Firestore · Functions
WordPressREST · plugins · XML-RPC
Strapidraft preview · roles
GraphQLintrospection · depth probe
RESTOpenAPI/Swagger · headers
A report in under two weeks, not six.
Most engagements wrap from kickoff to delivered report inside two weeks. Critical findings are escalated the moment they're confirmed, so you can patch in parallel and start closing audit evidence this sprint — not next quarter.
We talk during the test. Not just after.
Critical bugs hit your channel the moment we confirm them, with the exact payload and a one-line repro. You can ship a fix while we keep testing the rest of the surface — no surprises buried in a PDF a week later.
Production-safe by design.
Scope is locked before we start, traffic is rate-limited, destructive payloads are gated, and any test writes are reverted on completion. Run us against staging or live — we've never taken down a customer environment.
06
AI does the grunt work. A human signs the report.
AI handles fuzzing, payload generation, and first-pass triage at machine speed. A senior pentester validates every finding, eliminates false positives, and signs off the deliverable — so your SOC 2, ISO 27001, and GDPR auditors accept it without questions.
CWE-89
CWE-79
CWE-639
CWE-918
CWE-287
CWE-942
CWE-915
CWE-862
Real finding, real engagement
A finding from last month's report.
Below is a redacted excerpt from a recent engagement. Every finding you receive follows the same shape: severity context, reproducible proof, exploitation path, and a remediation you can ship the same afternoon.
finding-006
Cross-tenant data leakage in GET /rest/v1/profiles
Enable Row Level Security on the profiles table and add a policy that restricts SELECT to rows where org_id matches the authenticated user's tenant claim, e.g. USING (org_id = (auth.jwt()->>'org_id')::uuid). Keep service-role access narrow and add a regression test that asserts cross-tenant reads return 0 rows.
Effort: medium — one migration, one policy, one test
Real objections from founders, CTOs, and security leads — answered straight, with the trade-offs on the table.
Will testing break our production environment?
Production safety is non-negotiable. Scope is locked at kickoff and three violations abort the engagement entirely. Every write, upload, or delete the AI performs is logged, reverted before the report ships, and the reversal is verified by re-reading the affected resource. Destructive checks — writes, uploads, rate-limit floods, privilege escalation — are strictly opt-in. If you'd rather we stay read-only, we stay read-only.
Do I need to give you access to source code?
No. We default to gray-box: you hand over test credentials for a few user roles, point us at the target, and we work from there. That's how a real attacker with stolen creds operates, and it covers the vast majority of what you need. If your codebase is sensitive enough that you want source-aware testing — for cryptographic logic, internal APIs, or specific modules — we offer that as an add-on. Most clients never need it.
What compliance frameworks does your report satisfy?
The deliverable is built to slot into the audits you're already running. Findings are mapped to OWASP Top 10 2021, ASVS 4.0.3, CWE, CVSS 4.0 scoring, and MITRE ATT&CK techniques. The signed attestation letter satisfies SOC 2 Type II, ISO 27001 (specifically Annex A.12.6 and A.18.2), GDPR Article 32, and PCI DSS Requirement 11.3. Auditors have signed off on it. If your framework needs a specific format, ask in the scoping form and we'll confirm before you commit.
Can't AI just do a pentest?
Honestly? Not on its own — and anyone selling pure-AI pentests is selling a vuln scanner with better marketing. AI handles the scale: thousands of probes, payload variations, and edge cases a human couldn't realistically cover. But every finding gets reviewed by a human pentester who confirms exploitability, kills the false positives, and signs the attestation letter personally. That split is exactly why our pricing stays accessible while the report stays defensible in front of auditors and acquirers.
How long does it take?
Sprint tier runs about a week from kickoff to delivered report; Range typically lands inside two weeks end-to-end. Testing itself takes 3 to 8 business days depending on scope, the report ships within 2 days of testing, and retests usually come back the next business day after you ship fixes. Continuous tier runs continuously, with fresh reports each cycle. If you're staring down an audit deadline or a customer questionnaire due Friday, tell us in the scoping form and we'll prioritize.
What happens if you find something critical during testing?
You don't wait for the report. Anything we classify as critical or high triggers an immediate notification — email, or Slack if you've connected it — with enough detail to start remediating. That includes the affected endpoint, reproduction steps, and a CVSS 4.0 score. PII is masked and secrets redacted in everything we send (j***@example.com, {REDACTED_TOKEN}), so the alert is safe to forward to your engineering team without leaking anything sensitive.
Do you offer retesting after we fix the findings?
Yes, and we recommend it — a finding isn't really closed until someone has tried to break it again. Retesting is bundled into every tier: one free retest within 30 days on Sprint, two within 60 days on Range, and unlimited retests as you ship fixes on Continuous. You patch, ping us, and we re-run the relevant checks. Retest reports reference the original finding ID so your auditors can trace the full remediation cycle in one document.
Can you test our mobile app too?
Not the binary itself — yet. Native iOS and Android testing is on the roadmap but isn't live. The good news: the mobile app is mostly a thin client over your API, and that API is exactly what we test best. Auth flows, session handling, IDOR, broken access control, and data exposure live on the backend, and that's where the serious findings hide anyway. If your mobile risk is genuinely client-side (jailbreak detection, cert pinning), we'll tell you upfront.
Why do your prices say "From" instead of a fixed number?
Because pretending one number fits every codebase would mean either overcharging small scopes or underdelivering on big ones. Scope drives cost: how many endpoints, how many roles, whether destructive testing is opt-in, whether you want retests bundled. Fill in the 2-minute scoping form and you'll get an exact fixed price in the proposal — no estimates, no "+ travel". In practice, most engagements land within 20-40% of the starting price, and you see the final number before you commit.
Where are you based?
Portugal, EU. We run on our own infrastructure inside the EU — no offshoring, no subcontracting, no mystery third parties touching your data. That matters for GDPR data-residency questions and for the "who exactly is logging into our system?" question your security team will ask. The human reviewer signing your attestation letter is on our payroll, in our office. If you need a DPA or a specific data-handling clause for procurement, we'll have it back to you the same day.
Ready to find out what's exposed?
Fill out a 2-minute scoping form and get a fixed-price proposal within 24 hours. No call required, no commitment, no sales pitch.