Aegis proves you own the target, tests it like an attacker — signed in, across every role and parameter — and hands you a boardroom-grade report. No consultants, no scheduling, no six-week wait.
Every scan produces this. It's the controls-tested evidence that NodeZero, Pentera and Bright sell as an enterprise line item — the record of exactly which attacks were run and what held — generated automatically and dropped into every Aegis report, at self-serve prices. It documents the controls we exercised; it is not a guarantee your systems are secure.
This is the section other reports don't have: not what broke, but what we attacked and found holding. It is the evidence a reviewer needs to accept a clean result — and it answers SOC 2 CC4.1 directly. How verified controls work →
The numbers below are our own last self-test: the same aggressive suite a paying customer gets, aimed at our live production. Clean on every serious class; the two hardening items it flagged, we shipped the same day. And because a clean result only counts if the tools can find things, we also run Aegis against a public, deliberately vulnerable app (OWASP Juice Shop) — it finds the planted critical SQL injection with zero false positives.
Every gate is automated and fail-closed. A human never has to approve a safe scan — but nothing runs until ownership and rules of engagement are satisfied.
Drop one DNS TXT record. Aegis confirms you control the target before anything is queued.
Confirm scope, rate limits and emergency contact. Your acceptance is recorded, not a checkbox theatre.
The policy engine approves and dispatches the scan to an isolated worker — no operator in the loop.
Executive summary, severity chart, reproducible findings and remediation — ready to hand to an auditor.
A traditional pentest needs people for the parts that don't scale — scoping calls, scheduling, sampling by hand, writing the report weeks later. We didn't remove the human to cut corners. We removed the corners that needed a human.
Scoping becomes cryptographic ownership verification. Kickoff becomes recorded rules-of-engagement acceptance. Approval becomes a fail-closed policy engine. Every gate a consultant used to run by hand is codified — so the only thing left for you to do is start.
A consultant samples — a slice of endpoints, a couple of roles, whatever the billed hours allow. Aegis runs the same attack classes across every reachable parameter and every role-pair, the same each time. The more your product grows, the more a human misses and the more automation pulls ahead. Depth is bounded by your application — never by someone's hours.
Executive summary, severity distribution, reproducible findings, remediation steps — and a Verified Controls section: evidence of the controls we tested and what held. It's generated the moment testing ends, dated and retained, mapped to ISO 27001 A.8.8 and SOC 2. The evidence platforms charging five times as much still don't hand you.
Enterprise scale doesn't change the answer — it strengthens it. More endpoints, more roles and more tenants are exactly what deterministic, machine-scale testing covers better than a sampled human engagement. The one place a person still leads is novel, creative logic no scanner has seen — so we don't ask you to replace your pentester. Aegis is built to run continuously between your formal human tests, and we tell you plainly when a human is the assessment you need instead of pretending otherwise.
No sales call, no waiting on a reply — the answer appears as you click. The right tier depends on what you're testing and what you're allowed to touch.
Your match appears here instantly — with what you need to have ready.
Nothing here is a surprise mid-flow. Have these in hand and a baseline runs in minutes.
You'll add one DNS TXT record to prove ownership. We never scan a target that hasn't been proven — no exceptions, no manual override.
Whoever manages your DNS (Cloudflare, Route 53, your registrar) needs to add the record. Takes a minute; propagation is usually fast.
All tiersMost providers allow testing of your own resources, but their policy is yours to follow. See the matrix below — you'll confirm this before anything runs.
All tiersFor authenticated testing: a low-privilege account we can log in as. Never use a real customer or admin account. Rotate the password afterwards.
Authenticated +State-changing tests write data. They run against staging or a disposable copy — never your live system. We enforce this in code.
AggressiveA testing window plus someone reachable while it runs. You keep an emergency stop that halts everything immediately.
AggressiveSecurity testing traffic can look like an attack. Check your provider's current policy before you run — and if you're behind a WAF or rate limiter, allow-list our traffic so results aren't distorted by the edge blocking us.
| Provider | Typical position | What you should do |
|---|---|---|
| DigitalOcean | Testing your own Droplets is generally permitted under their AUP. | Review the current AUP; keep testing to resources you own. |
| AWS | Customer-initiated testing of many services is permitted without prior approval; simulated DoS still requires it. | Check the current customer support policy for penetration testing. |
| Microsoft Azure | Pre-approval generally not required; their Rules of Engagement apply. | Read the Azure penetration testing Rules of Engagement. |
| Google Cloud | No pre-approval generally required; the AUP applies. | Confirm against the current Google Cloud AUP. |
| Cloudflare / any WAF | Your origin is yours to test — their infrastructure is not in scope, ever. | Allow-list the scan so the WAF doesn't mask real findings. |
| Shared hosting | Often restricted, because neighbours share the machine. | Get written permission first, or test a copy you control. |
Policies change. This table is a starting point, not legal advice — verify your provider's current terms. Aegis never tests provider infrastructure (Cloudflare, DigitalOcean, AWS and the like); only the application at the target you have proven you own.
One plan, priced by the number of applications you test — everything included. No tiers, no contract, cancel anytime. Aggressive testing is self-serve but approval-gated and non-production only; there's no sales call.
Free shows the counts. Upgrade to see what they are and how to fix them.
Start free16+ targets? Contact us
A target is one application at one URL you've verified you own — so your production app, its staging site, and your API count as three targets. Each target includes 2 scans a month; another $50 adds 2 more scans anywhere on your account. Minimum 2 targets; $50/target from 2–9, then capped at a flat $449/mo for 10–15.
Flat USD, no contract, cancel anytime. See how it compares to Astra, Intruder & Acunetix →
No feature tiers. Every paid target gets the full depth below; the free baseline is the top group. Grouped here from the always-on baseline to the deepest approval-gated tests.
Low-rate, non-destructive checks on your public surface. Auto-runs the moment ownership and rules of engagement are satisfied.
Aegis logs in as your roles and tests the surface real users see — where the real risk lives.
The deepest non-destructive suite — the full injection battery, self-serve on live production. State-changing business-logic and multi-tenant isolation run self-serve too — approval-gated, against a non-production target you designate in-app. No sales call, and no engineers: the platform runs and gates everything automatically.
Price isn't the moat — anyone can discount. The combination is: self-serve and authenticated, deep coverage and an evidence report (the controls we tested and what held) you can hand an auditor, delivered straight into your Slack, Teams, Jira, GitHub or CI so fixes get triaged where your team already works — run continuously between your formal human pentests. The autonomous/AI pentests now on the market increasingly do authenticated and business-logic testing too; the real differences are price, whether it's genuinely self-serve, and whether it runs continuously rather than as a one-off engagement. Aegis does the deep, authenticated work — business logic, object- and function-level access control, multi-tenant isolation — self-serve and continuously, at a fraction of their price, and is one of the only self-serve platforms that confirms indirect LLM prompt-injection out-of-band. That's where we focus.
| Provider | Start without a sales call | What it tests | Controls-tested evidence report | Typical price |
|---|---|---|---|---|
| Aegis | Yes · same-day | Authenticated · full injection suite · IDOR & access-control · business-logic & tenant isolation (approval-gated) | Yes — Verified Controls | $1,499 one-off · $149–499/mo |
| Aikido | Yes | AI-automated app & code-security platform | — | ~$4,000 |
| Astra | Yes | Automated DAST + manual pentest (higher tiers) | — | ~$1,999–5,999 / yr |
| Intruder | Yes | Automated scanning + AI-powered app pentest | — | ~$3,500–4,000 pentest |
| BreachLock | Scoping call | Human-led + automated PTaaS | — | from ~$5,000 |
| Cobalt | Scoping call | Human-led PTaaS + autonomous pentest | — | ~$3,500 autonomous · to $50k |
Compiled from each vendor's public site and list pricing, August 2026; capabilities and prices vary by plan — check current terms. Several of these now offer autonomous or AI-assisted pentests too — the differences are price, depth, and whether you get a controls-tested evidence report. Aegis tests the running application — authenticated, full injection and access-control, with business-logic and tenant-isolation testing as self-serve, approval-gated add-ons — but not source code, dependencies or containers; here's exactly when we're the wrong choice.
Confidentiality statement, executive summary, a severity distribution, a master findings table and — for every finding — description, business impact, step-by-step reproduction and remediation. It closes with a signed letter of attestation — scope, methodology, dates and result — the one-page proof auditors and prospects ask for. Plus something the incumbents don't give you: a Verified Controls section — evidence of the controls we tested and what held. When separate findings combine into a multi-step exploit path — SSRF to cloud metadata, IDOR plus BFLA to account takeover, or an LLM lethal-trifecta — the report composes the whole attack chain, not just the isolated bugs. Your auditor decides what satisfies their framework — this is built to give them what they ask for.
Built as audit evidence. The report is structured to answer ISO 27001 A.8.8 (technical vulnerability management) and SOC 2 CC7.1 / CC4.1 — scope, methodology, dated findings, remediation and control verification. See the control mapping →
Generate your first reportNo target is ever scanned until DNS ownership is independently proven. Private and reserved networks are refused by policy.
Every assessment belongs to one tenant. Cross-tenant access is impossible by construction, and scans run in isolated workers.
Aggressive, state-changing testing is off unless you explicitly authorise it against a non-production target. Emergency stop always available.
A clean result is worthless if the scanner simply wasn't looking. The whole risk with automated testing is a false sense of security — so we build against it three ways, and it's the same for your report as for ours.
We plant known-vulnerable routes into a disposable build every release and confirm the detectors catch every one. A suite whose silence you can trust has to prove it can shout.
No finding ships without a step-by-step repro. That's what keeps false positives out — if we can't reproduce it, it isn't reported.
Not just what broke — the specific attacks we ran and the target held against. It's the evidence a reviewer needs to accept a clean result. See it run on us →
Aegis is built by Backbone Solutions, the team behind Atlas, our procure-to-pay platform. We built the Aegis engine because we needed serious, repeatable application-security testing for our own software — without booking a $5,000 consultant engagement every release. It worked well enough on ourselves that we opened it up.
We're a small, product-led team, so you won't find a page of executive bios here. We think the more honest introduction is the engine itself — pointed at our own production, with the result published in full. Everything this site claims, we run on ourselves first. If we won't dogfood it in public, you shouldn't trust it on your app.
Automated tooling — not a CREST-accredited human consultancy. Some frameworks (PCI DSS 11.4, certain government procurement) still require a qualified, independent human tester, and we'll tell you when that's you. For everything in between, Aegis is the continuous testing that runs between those engagements. When a human tester is required →
Aegis is unsupervised automation. We'd rather be plainly honest about that than bury it in a PDF.
You confirm you own the target or are authorised to test it, and you accept the rules of engagement before anything runs. Ownership is proven by DNS, and that record is your authorisation. Testing systems you do not own is unlawful in most jurisdictions and is a breach of these terms.
Findings are produced by automation. It will not replicate a skilled human attacker's creativity, and no automated test proves the absence of vulnerabilities. A clean report means the tests we ran found nothing — not that your system is secure.
Security testing sends real traffic. Even non-destructive checks can surface latent faults, trip rate limits or fill logs. Aggressive tiers write data by design. You are responsible for backups, a rollback plan and choosing an appropriate window — which is why aggressive testing is restricted to non-production targets.
The service is provided "as is", without warranty of any kind. To the maximum extent permitted by law, Backbone Solutions is not liable for indirect, incidental or consequential loss — including downtime, lost data, lost revenue or reputational harm — arising from use of the service. Total liability is limited to the fees you paid in the preceding twelve months.
Reports support a defensible security process and can be shared with auditors under NDA. They are not a certification against SOC 2, ISO 27001, PCI DSS or any other standard, and are not legal advice. Your auditor decides what satisfies their requirements.
Findings and evidence belong to you, are encrypted at rest, and are scoped to your workspace alone. Evidence is redacted server-side before storage. You can export or delete your data at any time.
Summary only — the binding text is in the Terms of Service, Acceptable Use Policy and Rules of Engagement, which you accept at sign-up.
Verify a domain, accept the rules, and let Aegis do the rest. Free to start.
