I built PentestPro: a real automated penetration testing platform for people who are sick of paying $15,000 for a PDF

I got tired of watching small businesses and indie SaaS founders get two options for web security: pay a consulting firm $15K and wait 3 weeks for a report, or run a free scanner that spits out 400 noise alerts and calls it a "pentest."

Neither of those is acceptable. So I built a third option.

What PentestPro actually does

It runs a full penetration test on any web application — the same structured process a manual security consultant follows — automated, in minutes, and it produces a professional PDF report you can hand to any auditor, enterprise client, or investor.

Not a "grade." Not a traffic light. A real report with:

Every vulnerability found, named, and explained

CVSS v4.0 risk scores on each finding

Working proof-of-concept exploit code so you can see exactly how bad it actually is

Step-by-step fix instructions mapped to your specific tech stack

OWASP Top 10, PCI DSS, SOC 2 compliance mapping baked in

The tool stack (because I know you'll ask)

18 integrated security tools: ZAP, Nuclei, SQLMap, Nmap, GoBuster, Wapiti, Commix, Semgrep, and more. Running across 7 structured phases: Recon → Mapping → Vulnerability Scan → Advanced Scanning → Exploitation → AI Analysis → Report.

The AI layer is Shannon — powered by Claude Sonnet 4 (Anthropic). It doesn't just list findings. It chains them together. "This CORS misconfiguration + this SSRF vulnerability = someone can reach your internal API from the outside." That's the attack chain your developer needs to see, not a list of isolated issues.

Why I built this

The manual pentest industry has a dirty secret: most of what they bill you for is running the same tools I've integrated, then writing a Word doc around the output. The insight isn't in the tooling. It's in the analysis.

Shannon does the analysis. You get the report. Your developer gets the fix instructions. No 3-week wait. No $15,000 invoice.

What it covers that matters

SQL injection, XSS, CORS misconfigs, exposed secrets in JavaScript

GraphQL introspection vulnerabilities

Subdomain enumeration and takeover risks

OWASP LLM Top 10 (yes, it tests AI/LLM endpoints if you have them)

Authenticated scanning — it logs into your app and tests what's behind the paywall, which is where the real vulnerabilities live

API scanning mode for REST and GraphQL backends

Privacy and data

Your scan targets and findings are yours. I'm not selling them, analysing them for ad targeting, or storing them for anything beyond your account. The platform is built on Google Cloud Run with Cloud SQL — not because I love big cloud, but because it's the most reliable way to run a scanning pipeline at this scale without 3am outages.

Pricing

Basic is $29/month. Pro is $99/month. Enterprise is custom.

I know. Another subscription. But running 18 security tools in parallel on cloud infrastructure costs real money, and I'd rather charge you honestly than sell your vulnerability data to make up the difference. The alternative was adding an ad network to a security platform, which is insane.

The honest limitations

It is automated. A senior human pentester doing a focused engagement will find things Shannon won't. If you're going into an IPO or need to satisfy a serious enterprise security team, use both — us for continuous coverage, a human firm for the deep annual engagement.

For everyone else: you probably have SQL injection on your search endpoint right now and you don't know it. Run a scan.

pentestpro.app

Happy to answer anything. And if you find something wrong with it, tell me — I'd rather hear it here than from a breach notification.

PentestPro

About