Concepts
EASM vs. DAST: Why You Need Both for Modern Infrastructure
External Attack Surface Management maps what is exposed; DAST actively tests for vulnerabilities. Neither alone gives you the full threat picture.
Read articleResources
Docs & Blog
Technical documentation, integration guides, and in-depth articles on offensive security and the PentestCheck Validation Pipeline.
Full documentation launching soon. In the meantime, explore our blog or contact us for early access.
Docs
Coming SoonGetting Started
Deploy your first scan in under 5 minutes. Submit a target domain, select Basic (EASM) or Deep (DAST) mode, and initiate.
Coming SoonManual Penetration Testing
Human-led penetration testing service — Black Box, Gray Box, or White Box. Real attack chains, compliance-ready reports. Starting at $1,000.
View ServiceWebhook & Integration Guide
Webhook integration guide — configure real-time alerts for Slack, Discord, Telegram, Teams, and custom endpoints.
Coming SoonScan Modes (Basic vs. Deep)
Understand what each mode covers: Basic (Asset Discovery + Port Intelligence + HTTP Fingerprinting + Vulnerability Scanning) vs. Deep (+ Web Crawling + Injection Validation).
Coming SoonIntegrations & Webhooks
Configure real-time notifications for Slack, Discord, and Telegram. Payload examples and severity-based filters.
Coming SoonFAQ
Frequently asked questions on authorizations, plan limits, false positives, and how to interpret the Threat Score.
Coming SoonBlog
Security
OWASP Top 10 2025: What Changed and Why It Matters
Security Misconfiguration moved up to #2, two categories are new and SSRF was folded into Broken Access Control. The full 2025 list and what changed since 2021.
Read articleProduct
Understanding the PentestCheck Threat Score: A 0–10 Risk Quantification Model
How the Threat Score is calculated — CVSS severity weighting, finding density, asset exposure, and attack surface breadth.
Read articleDeep Dive
Subdomain Takeover: How Attackers Exploit Dangling DNS Records
How dangling CNAME records create takeable endpoints, how attackers claim them, and how automated EASM detection prevents this class of vulnerability.
Read article