We bet we'll find a High or Critical in your app.
If we don't, you pay nothing. Run it yourself on our portal, or let us run it for you with no card needed.
Start nowWho takes the bet
You only pay if the agents prove something serious, so the risk sits with us.
Teams shipping fast
Check a new release or a big feature before it reaches customers.
Teams new to AI pentesting
See real results on your own app before you commit to anything.
Security leads who need proof
Hand engineers findings with the evidence to reproduce and fix them.
How it works
A black-box web assessment: the agents see your app the way an outside attacker does. We need your URL and nothing else. Test logins are optional, for reaching what signed-in users can see.
Discovery
The agents map your attack surface without sending any attack payloads: subdomains, exposed services, pages and the user flows behind them. What they find is saved, so later runs build on it.
Assessment
They attack each flow Discovery found, logged out and as each user role you give them. They never test beyond what Discovery found.
Validation
A separate validator accepts a finding only if it points to proof, such as a captured response, a callback from your server or the browser's state. Severity reflects only what was actually shown.
Retest
Fixed something? Retest the finding. The agents replay the same attack path and mark it resolved or unresolved.
Two ways to start
Run it yourself
Needs a card. No High or Critical found, we refund you.
- Create an account on the Pentest Copilot portal and add a card.
- Once our team validates your request, we add credits to your account.
- Add your domain and verify it with a DNS record.
- Start a web assessment. Record a login if you want logged-in pages tested.
- Watch findings arrive in the portal, each with its evidence.
- No High or Critical found? We refund you.
We run it for you
Free unless we prove a High or Critical.
- Send your app's URL below.
- We confirm it's yours. No card needed.
- The agents test the app end to end.
- You get the report. No High or Critical, no invoice.
Tell us where to start
The bet, in plain terms
- One web application, tested from its URL.
- High means a CVSS score of 7.0 or more.
- Every finding comes with the evidence that proves it.
- When we run it for you, no card or payment authorization is needed to start.
- When you run it yourself, a card is required. No High or Critical found, we refund you.
- If we prove a High or Critical, you pay the same as our standard plan.
- No High or Critical proven: you pay nothing and keep the report.
Questions
Do you need our source code?
No. This is a web application assessment. The agents work from your URL, the way an outside attacker would.
Is a person doing the testing?
No. AI agents run the whole test, and a separate validator checks every finding before you see it. If we run it for you, our team only sets it up.
What if you only find medium or low issues?
If we ran it for you, there's no invoice. If you ran it yourself, we refund you. Either way, you keep the full report with every finding and its evidence.
Will testing affect our app?
We follow your testing policy, including any scope, rate limits or testing windows you set. If we need anything else before we start, we'll reach out to you.
Worst case, you get a free report.
Start now