AI agents test your web app, API, network or source code, overseen by humans. A second agent reproduces every finding before you see it, so the report is evidence you can hand to a SOC 2 auditor or an enterprise customer. Free unlimited retesting.
Black box $3,000 · Gray box $4,000 · White box from $7,000
The 24 hours start once scope, signed rules of engagement and test access are confirmed.
Also from Helix Cyber: Fortify, code review on every pull request ↓Protect, monitoring and threat hunting ↓
What we test
Both halves get the same agents, the same second-agent reproduction, the same report and the same free retests.
01 · The software you have always shipped
Access control between users and tenants, business logic, injection, exposed services and misconfigured cloud accounts. Fixed prices for a typical scope.
02 · The AI you are shipping now
Prompt injection through documents and tool results, agents calling tools beyond the user's role, retrieval that crosses tenants, and data leaving through rendered links. Quoted after scoping.
You order the test, sign off the scope, watch it run and work through the results in one portal. Five steps, and nothing reaches your findings list until a second agent has reproduced it.
Pick a web app, API, external network, or source-code audit, then choose black, gray, or white box. Add the domains, URLs, IP ranges, and repositories in scope. Each asset is checked for ownership before anything runs.
Your owner or admin signs the rules of engagement in the portal. The signature is bound to the exact assets, exclusions, test window, and source archive hash. No traffic is sent before it exists.
Recon, focused testing, and verification run as separate agents in sandboxed desktops on private inference. Testing is detect-only by default, with no denial of service, no brute force, and nothing destructive outside resources the test creates itself.
The agent that finds an issue is never the one that confirms it. Anything that cannot be reproduced stays a candidate and never reaches your findings list.
Findings move from reported to remediating to resolved. Mark a fix ready and the retest attacks it again, then the dashboard tracks open and resolved issues over time.
Our own portal, tested by our own agents: open findings by severity, what has been resolved, and how the count has moved since the last retest.
Every engagement shows where it is in the lifecycle, from draft to delivered. Assets are marked verified, the scope summary is written in plain language, and white-box source archives are pinned by SHA-256.
Each finding gets a ticket ID, severity, and status. Filter by either, open the evidence, and mark a fix ready for retest when it ships. Reports, retests, credentials, and activity sit in the tabs next to it.
This is the full report from a gray-box engagement we ran against OWASP Juice Shop, a deliberately vulnerable app, start to finish on our own platform. Sixty-seven findings, each one reproduced by a second agent before it was written up, with a request-and-response proof, a severity rationale, and a fix for every issue.
JUICE-05-001
Reproduced by a second agent. The full entry carries the request and response proof and the counterevidence considered.
Pricing
Black box is $3,000 USD, gray box is $4,000 USD, and white box starts at $7,000 USD for a typical web app or API. Manual tests of a similar scope usually cost more and are booked weeks out. Retesting is free and unlimited, and we confirm the scope before testing begins.
Black box
$3,000 USD
One web app or API
No internal access. We test the exposed app or API and its reachable attack surface as an external attacker would.
Free unlimited retests included.
Gray box
Usual SOC 2 choice$4,000 USD
One web app or API
Test accounts let us check access control between roles and tenants, the part auditors and enterprise customers care about most.
Free unlimited retests included.
White box
From $7,000 USD
Priced after review
Pricing depends on codebase size, repository count, dependencies, architecture, and the depth of review required.
Free unlimited retests included.
Black and gray box prices cover a typical, well-bounded single web app or API. White box pricing depends on codebase size, repository count, dependencies, architecture, and review depth. Larger applications are scoped separately. Retesting is free and unlimited. See what a web application test and an API test cover.
Larger scope? Talk to usEach report records methodology, coverage, findings, severity and remediation status for the audit or review that asked for it, and the agents run on models we host, not a third-party AI provider.
Scope reports for SOC 2 Type I or Type II, ISO 27001, PCI DSS, a customer security review, or an internal risk assessment. Each report records methodology, coverage, findings, severity, and remediation status.
Run open models on inference infrastructure you control. Your code, prompts, findings, and LLM calls are never sent to OpenAI, Anthropic, or another third-party model provider.
Also from Helix Cyber
Separate products, not part of a pentest engagement.
Continuous code security review and AI penetration testing that don’t stop at a report. Every finding is validated in a sandbox, explained, and carried through to a merged fix.
Security agents review every pull request for the bugs scanners miss: an authorization check that is skipped on one route, user input that reaches a query, a secret committed in a test fixture.
Each candidate issue is reproduced in a sandbox before you see it. If it cannot be demonstrated, it is dropped and never pages anyone.
Each finding names the file, the line, the request that triggers it and its severity, so an engineer can fix it and an auditor can trace it.
For each confirmed issue an agent writes the patch, runs your tests and opens a pull request. A person on your team reviews and merges it.
Agents discover what you run, wire into the monitoring you already have, and stand up a security data lake with detections built for your company, then watch it around the clock.
Agents keep an inventory of what an attacker can reach: domains, exposed services, cloud accounts, repositories and the people with access to them, updated as they change.
Works with the monitoring you already run: Prometheus, Grafana, PagerDuty and your SIEM. Alerts arrive where your team already looks.
Logins, deploys, cloud API calls and alerts from every system in one store you can query when something looks wrong.
Detections written for how your product works: an admin role granted outside the usual flow, an export far larger than normal, a deploy from an unknown machine.
Agents search the data lake around the clock for activity that matches no known job, then contain it, notify your team and record what they did.
Security work needs models that will discuss exploits and malware. Helix runs open models on infrastructure you control, so analysis does not stop at a refusal and your logs never leave.
A pentest shows where you could be attacked. Protect watches for the attack itself, every hour of the year, and acts on it.
How the AI SOC behind Protect works →Events from your systems arrive as webhooks and land in one store you can query. Agents compare what is running with what should be running, and a coordinator starts specialist agents to hunt the difference and contain it in parallel.
01 RECONCILE JOBS · Reality check
Compare observed state with the state your systems and policies say should exist.
02 HUNT · Anomaly search
Query the lake across time, join weak signals, and surface the sequence that matters.
03 RESPOND · Coordinated action
Contain, notify, remediate, and leave an evidence trail for the next decision.
One signal can wake a team. The coordinator keeps the work bounded, shares memory between agents, verifies the result, and turns every response into evidence for the next decision.
From $3,000, with free unlimited retests. The 24 hours start when scope, written authorization, and access are confirmed, and every finding is reproduced before it reaches your report.
