For consultancies and MSPs
Security reviews for the AI apps your clients are building
Agents and AI apps are being built outside your clients' audited environments. Review how they are hosted, what data they touch, which models they use and how their code and credentials are secured, then hand over a clear report.
No card required.
43-question risk review
Hosting, data access, AI model terms, credentials and agent tooling, with risk-weighted answers and automatic findings.
Client questionnaire portal
Send a private link. The client or their developer answers questions, uploads evidence and shares code; they never see your risk ratings.
Automated code and web testing
Scan a repository or upload for leaked secrets (including git history), vulnerable dependencies and insecure configuration, and test the live website with OWASP ZAP, all in an isolated sandbox.
Findings register
Track every finding across clients with owner, due date and status. Rescans update findings without losing your triage.
Client-ready reports
Executive summary, prioritised actions and full detail, printable as PDF, plus CSV for spreadsheets. Share results when you are ready.
Built for teams
Reviewer and read-only roles, activity log, and Microsoft Entra ID single sign-on on the Business plan.
SAST and DAST: two ways to test an application
AI-assisted code ships fast and often skips the checks a mature engineering team would run. Security testing comes in two complementary forms: one reads the code, the other attacks the running app. Each catches problems the other cannot see.
Static testing
SAST: inspect the code from the inside
Static Application Security Testing analyses source code, dependencies and configuration without running the application.
How it works
- Parses the code and matches it against rules for known insecure patterns, such as SQL built from user input, unsafe deserialisation or disabled TLS checks.
- Searches files and git history for leaked secrets like API keys and tokens.
- Checks dependency manifests against vulnerability databases and reviews infrastructure and CI configuration.
Why it matters
Runs early, before anything is deployed, and points to the exact file and line, so fixes are cheap. It can also see code paths a live test never reaches.
What it misses
It cannot see how the app behaves once deployed, so it misses server misconfiguration and runtime issues, and some findings need human triage.
Dynamic testing
DAST: attack the running app from the outside
Dynamic Application Security Testing probes a deployed application over HTTP, the way an attacker would, with no access to the code.
How it works
- Crawls the site or API to discover pages, forms and endpoints.
- Sends crafted requests, such as injection payloads, tampered parameters and malformed input, and watches the responses.
- Checks headers, cookies, TLS, authentication and error handling as they actually behave in that environment.
Why it matters
Confirms vulnerabilities are really exploitable and catches problems that only exist at runtime: hosting and server configuration, exposed admin pages, broken access control.
What it misses
It needs a running environment, runs later in the cycle, only tests what it can reach, and cannot tell you which line of code to fix.
Neither is enough on its own, so we run both. Code testing (SAST) scans a repository or upload for insecure code, leaked secrets, vulnerable dependencies and risky CI configuration. Web testing (DAST) uses OWASP ZAP against the live site, passively by default and with an active attack scan for staging, once the client has proved they own it.
How your clients' code and data are handled
Reviewing an application means handling sensitive material, so we keep as little of it as we can.
Source code is not kept
Each scan clones the repository or unpacks the upload into a temporary, isolated workspace. The workspace and the uploaded archive are deleted as soon as the scan finishes, whether it succeeds or fails.
Access tokens are discarded
A repository access token is used only to fetch the code for that scan and is deleted when the scan ends. Leaked secrets found in the code are redacted in the results.
Only the results remain
We keep the findings (file and line references, severity and guidance) and the dependency list, so you can triage and report. Scan results are deleted after 365 days.
The platform runs on Amazon Web Services (AWS), in data centres that are independently audited under SOC 1, SOC 2 and SOC 3 and certified to ISO/IEC 27001.
Simple pricing
Every plan starts with a 14-day free trial. Cancel any time.
Starter
For a consultant running a few reviews a month.
- ✓ 3 new reviews a month
- ✓ 20 code scans a month
- ✓ 2 team members
- ✓ Client questionnaire portal
- ✓ PDF and CSV reports
Professional
Most popularFor a security practice with a small team.
- ✓ 15 new reviews a month
- ✓ 100 code scans a month
- ✓ 5 team members
- ✓ Client questionnaire portal
- ✓ PDF and CSV reports
Business
For MSPs reviewing AI across many clients.
- ✓ Unlimited new reviews
- ✓ 500 code scans a month
- ✓ 15 team members
- ✓ Client questionnaire portal
- ✓ PDF and CSV reports
- ✓ Microsoft Entra ID single sign-on
Single review · $159 one-time
One review workspace with up to 5 code scans, the client portal and PDF/CSV reports, for 90 days. Use it within 12 months.
Prices in USD.