two cadences
Starter: one hunt a month. Growth: after each release you approve
100% PoC
every finding with a working PoC
NIS2 · ISO 27001
signed report + evidence mapping, included, not certified
For a company that ships a web or API product. One hunt a month on Starter. After each release you approve, on Growth and above.
The hunt only talks to hosts you authorized in writing, every request is logged, and you can stop it.
This is your authorization: what the hunt may touch. What isn't listed is never touched.
On Growth and above, they keep that map current between the releases you approve.
Growth and above stay watched between releases
Engineer agents map what an attacker could see from outside. On Growth and above, they keep that map current between releases.
A lead plans the attack and stays off the target, while engineer agents take one slice, with the playbook for that bug (access control, auth, business logic), and come back with a working exploit.
Nothing ships without a working exploit that a second agent has tried to break.
A check reruns the exploit without a model, and a validator agent tries to break it. Growth retests after each release you approve; Starter is one hunt a month, plus a retest of what you fixed.
Retestrelease 2.41 → fix verified ✓
A standing document with a signature: the one you hand to an auditor. On Growth and above, retested after every release.
A lead stays off the target while engineers take one slice and come back with an exploit.
We work like a real attacker: from the outside, on your authorized surface. We report only what we can prove.
We test for
We map your authorized internet-facing surface and exploit what we find to establish a real foothold.
We assess
From the foothold we test how far an attacker gets: to the assets that actually matter to you.
Starter is one deep hunt a month. On Growth and above, more hunts do not raise the bill.
Growth and above: every release you approve is retested. The fee does not grow with your release count.
Starter is one deep hunt a month on one app, still flat, still a signed report. Continuous coverage is Growth and above.
Repo access: every release diff read for data-flow issues. File:line + PoC, not scanner output.
The signed report as a compliance artifact: PAdES-B-T + qualified timestamp, evidence mapping. No extra cost.
This pipeline hunts live bug-bounty programs every day; your hunt runs on the same one. Full report list on request.
Order ID comes from the client, no ownership check on reads.
Tokens minted from a counter, not a CSPRNG.
No rate limit or lockout on the auth endpoint.
Full report list on request.
Rheono tests and signs. cSquare GRC maps the report to your SOC 2 / ISO 27001 / NIS2 / DORA controls and tracks the fixes. Your auditor decides. Neither of us audits or certifies you.
Your auditor reviews the evidence and issues the SOC 2 report or ISO 27001 certificate. That call is theirs, not ours.
from
€99/ month
Starter · one deep hunt a month. Continuous Growth from €499/month. Annual prices are on /pricing.
Published tiers on /pricing: Starter €99/mo, Growth €499/mo, Pro €999/mo, Business €2,499/mo. Enterprise custom. Free check first.
What the market charges right now: 2026 ranges by type, hidden costs, the flat comparison.Flat and predictable. No per-scan billing. Monthly or annual, both published on /pricing.
No validated High or Critical in the agreed scope, you don't pay. CVSS-scored, human-validated, in the signed report.
Agreed scope, signed report, CVSS scale. In writing in the contract.The test, the price, code access, your data — every question answered in writing, every answer with the next step.
Send us your domain. A researcher confirms your request, the check takes about 20 minutes (read-only, nothing reaches your systems), and then you have the short written report: what an attacker can realistically do with it. Yours whether or not anything follows. To continue, pick a published plan. The price is flat.