Only real findings
A person checks every result before release. Anything we could not prove stays clearly labeled.
Web app & API pentest. Clear evidence. Clear fixes.
Every month we hack one web app or API of yours, the way an attacker would. You get a report checked by people: what is wrong, what it could cost you, how to fix it. Then we test your fix.
Preparing a test? Read the cloud pentest checklist for SaaS teams, how automated vulnerability assessment compares to a manual pentest, and how to evaluate an AI security testing provider.
A clear report. Not a pile of alerts.
Evidence you can use
The report explains what happened, why it matters, and which practical fix fits.
An agreed next step
The retest criteria are clear, so your team can request the agreed scoped retest after the fix.
What is available now
From €500 per month excluding VAT: one pentest of your web app or API every month, a report checked by people, help with the fix and a retest. Larger systems on quote.
Frequently asked questions
How much does a pentest cost?
From €500 per month excluding VAT for one web app or API. Larger or more complex systems get a quote.
What happens each month?
We test the system named in your agreement, a person checks the findings, you get the report and we retest your fix. No separate signature per month.
How long does a test take?
About 10 business days after scope, access and the test rules are complete. We confirm the date with you.
Can you test behind a login?
Yes. Up to two test accounts or roles are included when they are in the scope.
Is it safe for production?
We agree exclusions, rate limits, a test window and a stop contact up front. Risky actions can be excluded and are then marked as untested in the report.
What is in the report?
A short summary for the owner, the evidence for your engineers, the business impact, the fix, and what we did not test.
Can I use the report as compliance evidence?
Yes. Findings are dated and reproducible, and the retest result is in the report, so an auditor or customer can use it as technical evidence for NIS2 / the Dutch Cybersecurity Act (Cbw), ISO 27001 or a security questionnaire. It is not a certificate and does not prove full compliance.
What is the difference between a vulnerability scan and a pentest?
A scanner lists known issues such as outdated software and missing headers. A pentest goes further: it chains findings, tests authorization and business logic, and proves impact with evidence. SKYEN combines both: up to 10,000 AI agents attack the target, then a person checks every finding before it reaches your report.
Is a pentest required for NIS2 or the Dutch Cybersecurity Act?
The law asks for suitable and proportionate measures and for evidence that they work; it does not name a pentest as such. A bounded web or API test is a common way to provide that technical evidence. The report is evidence, not a certificate, and your organisation decides what else it needs.
Can you test a webshop or an e-commerce platform?
Yes. Any webshop with a public website or API is a normal SKYEN target, including the checkout and account flows. Shopify storefronts go through the private Shopify pilot. We test with dedicated test accounts where possible and do not intentionally collect or download personal or payment data.
How do I request a quote, and how fast can testing start?
Use the form, the phone line or the site chat; we reply within one business day with a scoped proposal and a fixed price. Testing starts only after a signed agreement that names the target, exclusions and test window, so a request or a quote never starts a test.