Home/Product/Blackbox

Blackbox.
We start where an attacker starts.

Your red team plays an outside attacker: no accounts, no credentials, nothing shared.

No access, no credentials, nothing provisioned. We test your live product from the outside, continuously, and show you what's actually exploitable.

Talk to the founder →

Start at any level. Move between them whenever you like.

Blackbox
Nothing. Scope and permission only.
Greybox
Test accounts, API keys, docs, a sandbox.
Whitebox
Source, infrastructure, environments.
What we test

Everything a stranger can reach.

You give us a list of what is in scope and permission to test it. Nothing else.

Public surface
Domains, subdomains, exposed services and storage, including the ones your own inventory forgot.
Unauthenticated routes
Every endpoint that answers without a login, including the ones your UI never shows.
Account flows
Sign-up, login and password reset, tested the way an attacker would abuse them.
Shipped code
Secrets and internal detail leaked in the JavaScript and source maps you ship.

Best for
Seeing exactly what an outsider sees, without sharing anything.

The limit

What Blackbox cannot see.

Anything behind a login the agents cannot legitimately get past stays untested. That is the honest edge of an outside-in test, and it is where Greybox picks up. Everything in our Journal was found from the outside.

Greywatch
OverviewFindings1Assets2Rules4IntegrationsTeamSettings
Testing paused
First cycle complete · 17 attack paths queued · map still live
Continue testing
acme-health.com / AssetsPaused
Assets · Blackbox
Depth is inferred from what you connect, never a setting · every change logged
Connected
Bacme-health.comDomain · 4 hosts mapped · 1 excluded
In scope
BPermission to testSigned · production hosts allowed
On file
+ connect an account, key, environment or repo
Rules this access brings
BExclude third-party hostspartner-api.acme-health.com stays untouched
BNever run destructive actionsNo writes, no deletes · 1 sample, redacted
BRate limitPer host, enforced by the harness
20 req/s
BPause after each cycleNothing runs until you press Continue

Every asset you connect brings its own rules.
More access means more guardrails, never less control.

Read what Blackbox finds →

At every level

Same results, whatever you share.

Access changes how deep we can go. It never changes what you get back.

01
Continuous
Our AI agents test your live product the way an attacker would. Continuously, not once a quarter.
Agent activity
surface re-mapped after deploylive
auth boundaries re-tested4m ago
your last quarterly pentest83 days ago
02
Reviewed
A security engineer reviews every finding before it reaches you. You get a short list of real issues. Not 1,000 tickets.
Prioritized findings
IDOR on /api/patients/:idCritical
Overprivileged S3 policy on backupsHigh
Missing security headersLow
03
Reproducible
The exact request that worked, the data it exposed, step-by-step reproduction your engineers can run, and a recommended fix.
Reproduction
$ curl -H "Auth: <user-a>" \
  /api/patients/8815
← 200 OK · returns patient 8815
user-a is not patient 8815

Plans from $1,500 a month. See pricing →

Get in touch

Talk to the founder.

Tell us what you're building and what you're worried about. You'll hear back from a founder, not a sales rep.

✓ Thanks for reaching out. We'll be in touch shortly.