Automated Penetration Testing & Attack Surface Management
Map your attack surface, validate exploitability, and close gaps — on demand, or on a daily, weekly or monthly schedule (Starter and Pro).
THE PIPELINE
Four Engines. One Threat Score.
From asset discovery to remediation tracking — every stage of the attack lifecycle, unified in a single platform.
Attack Surface Discovery
Continuously maps your external perimeter — subdomains, open ports, and exposed services — before attackers find them.
Active Vulnerability Scan
Deep scans actively probe live endpoints for injection flaws, misconfigurations, and OWASP Top 10 exposures.
Threat Score Dashboard
Unified risk posture scored 0–10. Track remediation velocity, compare assets, and demonstrate security ROI to stakeholders.
Severity-Based Alert Routing
Critical findings trigger instant notifications via Slack, email, or webhook. OWASP-mapped remediation guidance per finding for immediate action.
Security Coverage at Every Scale
Start free and scale as you grow. Starter and Pro include a 7-day trial — cancel before day 8 and pay nothing.
Free
Prove the platform on your first target.
Starter
For growing pentest teams running continuous assessments.
Credit card required. Cancel before day 8 and pay nothing.
Pro
For mature security teams who need depth, scale, and integrations.
Credit card required. Cancel before day 8 and pay nothing.
Enterprise
For large organizations, MSSPs, and teams with compliance requirements.
Need a custom plan? Talk to Sales
FAQ
Frequently Asked Questions
What is PentestCheck?
PentestCheck is a continuous security validation platform that combines External Attack Surface Management (EASM) with automated DAST. It maps your exposed attack surface, validates exploitability across discovered endpoints, and delivers severity-scored alerts in real time.
How does the scanning process work?
Every scan discovers the subdomains of the domain you add, checks their open ports and fingerprints the web services it finds. The Nuclei vulnerability scan runs against the domain you added; discovered subdomains are listed so you can add them as their own targets. Deep mode (Starter and above) also crawls that domain and runs active SQL injection and file inclusion (LFI) tests. Only scan domains you own or are authorized to test.
Can I integrate PentestCheck with my existing tools?
Yes. PentestCheck supports Slack, Discord, Telegram, and Microsoft Teams via native integrations, plus custom webhooks for any tool that accepts HTTP. Severity thresholds are configurable — alert only on Critical or High findings, for example. Alert integrations are available on Pro and above.
Is my data secure?
Each organization's targets, scans and findings are isolated at the database level with PostgreSQL row-level security, applied on every request, and are never shared between organizations. We do not sell, license or share scan data with third parties.
What happens to my data if I cancel?
If you cancel a paid plan, your organization moves to the Free plan when the subscription ends, and scheduled scans for targets beyond the Free plan's 1-target limit are paused. Targets you delete are permanently erased after 7 days. The account owner can download a ZIP export of the organization's targets, scans, findings and members at any time from Settings.
How many scans can I run per month?
Free: 3 scans a month on 1 target. Starter ($59/month): 25 scans on up to 5 targets. Pro ($179/month): 150 scans on up to 25 targets. Enterprise: custom limits. The monthly count resets on the 1st of each month (UTC), and failed scans don't count.
Still have questions? Contact support