No security team. Ship anyway.
Agents pentest your web app and API on their own, and they only touch hosts you authorized in writing. One hunt a month from €99; continuous from €499, and more hunts don't raise that bill.
Read-only check. A researcher confirms before anything runs.
Start from €99Plans from €99/mo · read-only free check · ~20 min · permanent opt-out · or pick a plan
- 14:02:11acme.comsurface mapped — 3 hosts—live
- 14:02:36api.acme.com47 endpoints enumerated—live
- 14:03:02app.acme.com /checkoutsession token replayHIGHvalidating
- 14:03:19api.acme.com /api/v2/ordersIDOR probe queued—pending
- 14:04:51app.acme.com /accountPoC captured · CVSS 8.2HIGHverified
- 13:22:04acme.com — release v2026.09.12retested, no change—filed
A lead plans the attack off the target, and engineer agents come back with a working exploit.
Exploited long before it is known.
32.1%
of the vulnerabilities on CISA's Known Exploited Vulnerabilities list were already exploited before they were publicly disclosed.
Mean time to exploit: 6 days in 2023, 4 hours in 2024.
An annual pentest is a photo of one day. The window has closed. On Growth and above, coverage runs after every release you approve.
The same pipeline hunts live bounty programs.
The same agents pentest your web app and API.
Incorrect Authorization
Superhuman (formerly Grammarly) · Aug 28, 2026
- RHE-002criticalEXNESS
- RHE-033hightoom Baumarkt GmbH - Webshop
33 findings
A working exploit per finding. Signed report with NIS2 / ISO 27001-ready evidence, CVSS-scored.
The ledger so far.
- 33advisories published from live bounty hunts
- 01standing hunts running now
- September 2026first standing hunt filed
Three checks. One verdict.
A finding reaches you only after the hunt agent's exploit survives a validator agent trying to break it and a replay that reruns it without a model.
- Hunt agentFound
Sequential order IDs: 41 other customers' orders read.
- Validator agentHeld
Tried to break the PoC. It still reads foreign orders.
- ReplayPassed
Exploit rerun without a model. Same response, request and response captured.
Then it ships as a signed bundle: report, raw evidence, a working PoC and checksums. The shape of one, below. The full sample is one click away.
IDOR: sequential order IDs expose other customers' order history
- assetapi.acme.example/v1/orders
- pocpoc.sh — enumerates ids 1001–1010, all 200
- evidence41 foreign orders read · request + response captured
signed — S. Abis · NIS2 + ISO 27001 evidence
Snapshot. Noise. Proof.
annual / per-test pentest
- cadence
- once a year or per engagement
- what it proves
- depth on one day — then ages
- cost
- €3k–25k each time you ship
- the evidence
- a PDF that tests yesterday's app
scanner / alert feed
- cadence
- continuous, unattended
- what it proves
- possible issues — assumed
- cost
- per seat or per asset
- the evidence
- a dashboard of unverified noise
the standing hunt · ours
- cadence
- monthly on Starter · after each release on Growth
- what it proves
- validated exploit + PoC
- cost
- €99/mo one hunt · €499/mo continuous
- the evidence
- signed NIS2 / ISO ledger
Two cadences. Both flat.
Starter is one deep hunt a month. Growth and above hunt after each release you approve, and more hunts do not raise that bill. Validated findings, signed NIS2 / ISO evidence.
Starter
€99/ month
One app. One deep hunt a month. Validated findings, flat price.
Growth · most popular
€499/ month
Continuous coverage on one production surface — hunt hard after each release.
We look at your live site first.
Read-only, in ~20 minutes: at most ~300 page requests at ~1 per second, from one US IP. No logins, no test payloads, no port scanning. Nothing reaches your systems.
You get a short written report: every item, what we saw, what an attacker could realistically do with it, and what it would cost you. It is yours whether or not anything follows.
How we check →Straight answers.
Proof vs noise, continuous coverage, what we are not — then pick a plan or the free check.
- Is this continuous after every deploy?
- Starter is one deep hunt a month. On Growth and above, the hunt runs hard after each release you approve, then quieter until the next one — and more hunts do not raise that bill.
- Proof or another alert dump?
- Every reported finding passes a validation gate with a reproducible PoC. Unproven signals are never shipped. That is the product — not a CVE dashboard.
- Do I get a certified auditor letter? No.
- You get validated PoCs and a signed report with NIS2 / ISO 27001-ready evidence. Running SOC 2, ISO 27001, NIS2 or DORA? Our GRC partner cSquare GRC maps the report to your controls and tracks the fixes; your auditor decides. See pentest to audit.
- What does the free check touch?
- Read-only HTTP to your public site — limited rate, no logins, no payloads. The method is on checks & opt-out. Permanent opt-out is one word. Or skip it and start a plan.
Not the right fit if
- You need a one-shot engagement with a named methodology date for a contract clause — that is a separate manual letter, not this subscription.
- You need internal networks, mobile binaries, or social engineering — the standing hunt covers external web and API you authorize.
- You want 24/7 MDR-style monitoring, not a hunt that intensifies after each release and files a signed report.
- You only want a vulnerability scanner dashboard — we complement that; we do not replace a ticket queue of unverified CVEs.
If none of these is you, the free check is the honest way to see the shape of the work.
Proof on the cadence you pay for — not a yearly PDF.
Pick a published plan and start self-serve. Or run the free read-only check first if you want to see how we touch production.
Enterprise or MSP: write to sales@rheono.dev
flat price · validated PoCs · signed compliance evidence · free check available