No security team. Ship anyway.

Agents pentest your web app and API on their own, and they only touch hosts you authorized in writing. One hunt a month from €99; continuous from €499, and more hunts don't raise that bill.

release v2026.09.18hunt · intensive
  • 14:02:11surface mapped — 3 hosts—
  • 14:02:3647 endpoints enumerated—
  • 14:03:02session token replayHIGH
  • 14:03:19IDOR probe queued—
  • 14:04:51PoC captured · CVSS 8.2HIGH
  • 13:22:04retested, no change—
overwatch · quiet cyclenext intensive hunt waits for your go
report filedsigned — S. AbisNIS2 + ISO 27001 evidence · reproducible PoC

read-only check — a researcher confirms before anything runs

Start from €99

plans from €99/mo · read-only free check · ~20 min · permanent opt-out · or pick a plan

backed byGoogle for Startups

A lead plans the attack off the target, and engineer agents come back with a working exploit.

We look at your live site first.

Read-only, in ~20 minutes: at most ~300 page requests at ~1 per second, from one US IP. No logins, no test payloads, no port scanning. Nothing reaches your systems.

You get a short written report: every item, what we saw, what an attacker could realistically do with it, and what it would cost you. It is yours whether or not anything follows.

How we check
step 1 of 2

Nothing scans until a researcher confirms your request. We reply within one business day.

Exploited long before it is known.

32.1 % of the vulnerabilities on CISA's Known Exploited Vulnerabilities list were already exploited before they were publicly disclosed. Mean time to exploit: 6 days in 2023, 4 hours in 2024.

source: VulnCheck, State of Exploitation 1H-2025 ↗

An annual pentest is a photo of one day. The window has closed. On Growth and above, coverage runs after every release you approve.

The same pipeline hunts live bounty programs.

The same agents pentest your web app and API.

VercelZooplusExness
RHE-009criticalCVSS 9.0Pending disclosure

Incorrect Authorization

Superhuman (formerly Grammarly) · Aug 28, 2026

  • RHE-002criticalEXNESS
  • RHE-018highWeb.com Bug Bounty

26 findings

A working exploit per finding. Signed report with NIS2 / ISO 27001-ready evidence, CVSS-scored.

see a sample reportall advisories

The ledger so far.

updated live
  • 26advisories published from live bounty hunts
  • 01standing hunts running now
  • September 2026first standing hunt filed

Snapshot. Noise. Proof.

annual / per-test pentest

cadence
once a year or per engagement
what it proves
depth on one day — then ages
cost
€3k–25k each time you ship
the evidence
a PDF that tests yesterday's app

scanner / alert feed

cadence
continuous, unattended
what it proves
possible issues — assumed
cost
per seat or per asset
the evidence
a dashboard of unverified noise

the standing hunt · ours

cadence
monthly on Starter · after each release on Growth
what it proves
validated exploit + PoC
cost
€99/mo one hunt · €499/mo continuous
the evidence
signed NIS2 / ISO ledger

Full compare pages →

This is the document.

Every finding ships as a signed bundle: report, raw evidence, a working PoC and checksums. The shape of one, below. The full sample is one click away.

RHE-2026-041criticalCVSS 9.1signed

IDOR: sequential order IDs expose other customers' order history

  • assetapi.acme.example/v1/orders
  • pocpoc.sh — enumerates ids 1001–1010, all 200
  • evidence41 foreign orders read · request + response captured

signed — S. Abis · NIS2 + ISO 27001 evidence

sample report · fictitious dataopen the sample report

Two cadences. Both flat.

Starter is one deep hunt a month. Growth and above hunt after each release you approve, and more hunts do not raise that bill. Validated findings, signed NIS2 / ISO evidence.

Starter

€99/ month

One app. One deep hunt a month. Validated findings, flat price.

Growth · most popular

€499/ month

Continuous coverage on one production surface — hunt hard after each release.

Start a planThe guarantee →Or run the free check →

Straight answers.

Proof vs noise, continuous coverage, what we are not — then pick a plan or the free check.

Full FAQ →
Is this continuous after every deploy?
Starter is one deep hunt a month. On Growth and above, the hunt runs hard after each release you approve, then quieter until the next one — and more hunts do not raise that bill.
Proof or another alert dump?
Every reported finding passes a validation gate with a reproducible PoC. Unproven signals are never shipped. That is the product — not a CVE dashboard.
Do I get a certified auditor letter? No.
You get validated PoCs and a pipeline-signed report with NIS2 / ISO 27001-ready evidence. If a contract names a third-party human letter, budget that separately.
What does the free check touch?
Read-only HTTP to your public site — limited rate, no logins, no payloads. Method is on /security. Permanent opt-out is one word. Or skip it and start a plan on /pricing.

Not the right fit if

  • You need a one-shot engagement with a named methodology date for a contract clause — that is a separate manual letter, not this subscription.
  • You need internal networks, mobile binaries, or social engineering — the standing hunt covers external web and API you authorize.
  • You want 24/7 MDR-style monitoring, not a hunt that intensifies after each release and files a signed report.
  • You only want a vulnerability scanner dashboard — we complement that; we do not replace a ticket queue of unverified CVEs.

If none of these is you, the free check is the honest way to see the shape of the work.

Proof on the cadence you pay for — not a yearly PDF.

Pick a published plan and start self-serve. Or run the free read-only check first if you want to see how we touch production. Enterprise: write sales@.

Start from €99Start free check

Talk to sales →

flat price · validated PoCs · signed compliance evidence · free check available