Pay once. Pick how deep it goes.

Depth, not features. All three run the same assessment, produce the same kind of report, include the same AI fix prompts and include one fix verification re-check. What changes is how far the assessment gets: how much of your surface is mapped, how many leads are followed before it has to write up, and whether multi-step abuse paths such as skipping a payment step are actively pursued or only noticed in passing. Standard follows roughly two and a half times as many leads as Quick, and Deep roughly five times. Quick suits a pre-launch app with no payments or personal data; Standard suits a live product with accounts and paying users; Deep is for payments, personal data, multiple tenants in one database, or a security questionnaire you have to answer.

No, and we will not pretend otherwise. A penetration test is performed by a human specialist over days, includes manual exploitation and a formal report, and typically starts in the thousands. This is an automated assessment with prioritised findings, evidence for each one, and fix instructions. Where a contract, an auditor or a regulator requires a formal pen test, this does not replace it. For an early-stage product, the honest comparison is not against a pen test you were going to buy — it is against the security review that was not going to happen at all, and against the specific mistakes that actually put your users' data at risk.

A Quick check usually takes one to two hours, a Standard check a few hours, and a Deep check most of a working day. We would rather finish the work than stop early to look fast. You get an email the moment your report is ready, so there is nothing to sit and watch.

Each finding arrives with a plain-English explanation of what we found, why it matters, what could realistically happen, the affected endpoint, the evidence we collected, a severity rating, and a ready-to-use prompt for your AI coding tool. Findings are ordered so the thing that can actually hurt you is first, not the longest list. You fix them in your own time, with your own tools, and then use the included re-check to confirm.

You get the report anyway, and it is worth having. It lists everything that was tested, what held up, and the lower-severity items worth tidying. That document is what you send when a customer's procurement team, an investor or a partner asks what you have done about security — and "we had the live application independently checked, here is the report" is a far better answer than a promise. We do not pad reports to justify the invoice; a clean result is a result.

Yes, and with any other tool that has access to your codebase. Each prompt states the problem, the endpoint, the behaviour that is expected instead, and a test that proves the fix. Paste it in, review the change your agent proposes the way you would review any change, and deploy.

Yes. One fix verification re-check is included with every check, at every tier. After you deploy your fixes it re-tests the findings from your original assessment, against the same application, and tells you for each one whether it is resolved, still present, or inconclusive. It is deliberately not a second full assessment: new features, a new deployment target or a different app need a new check.

No. You pay once for the check you chose and that is the end of it. There is no plan, no seat, no renewal and no card kept on file for a future charge. Run another check when your app has changed enough to deserve one — after you add payments, open sign-ups, or let an agent refactor half the codebase.