Penetration Testing as a ServiceA platform, not a project.
A platform that pentests continuously, not an annual engagement.
Findings land as validated PoCs and merge-ready fix PRs, not a PDF.
Trusted by security teams at
What is penetration testing as a service?
What to look for in a PTaaS platform
The label covers very different products. These are the criteria that separate a true continuous service from a scheduling portal for consultants.
Real testing cadence
Some PTaaS vendors still run point-in-time tests you book through a portal. A continuous platform tests every deploy and pull request without scheduling anything.
Validated findings
Findings should arrive with a working proof-of-concept, not a severity guess, otherwise your team inherits the triage work the vendor skipped.
Remediation in the dev workflow
Look for fix PRs, CI integration, and automatic retesting on merge, not a report your engineers must translate into tickets.
Coverage breadth
Web apps, APIs, code, cloud, and infrastructure from one platform, so coverage does not fragment across vendors.
Data control
Where does testing run, and who sees your source and findings? Self-hosted or air-gapped options matter for regulated environments.
Compliance evidence
SOC 2, ISO 27001, and PCI DSS auditors accept continuous evidence. A platform should export it for the full period, on demand.
How Strix delivers PTaaS
Strix is the autonomous take on the model: agents run the pentest end to end, continuously, inside your own perimeter if you want.
Agents map and attack
Autonomous agents enumerate your attack surface and chain real exploits across code, APIs, web apps, and cloud, on every deploy.
Proof before report
Every finding is exploited and reproduced before it reaches you, so confirmed risk is all you triage.
Fix shipped with the finding
Each finding arrives with a merge-ready pull request, and agents retest after merge to confirm the vulnerability is gone.
Native to CI/CD
Testing runs on pull requests and deploys, so results land where your engineers already work.
Yours to run
Open-source core, self-hostable, air-gappable, and BYO-LLM, the service model without surrendering your data.
Priced like a platform
Start free on the open-source core or from $29/seat/month hosted, not $25k–$96k per year for a fixed number of tests.
PTaaS delivery models compared
Human-led PTaaS marketplaces and autonomous platforms share the name but deliver very differently.
Strix (autonomous PTaaS)
Human-led PTaaS
Strix (autonomous PTaaS)
Human-led PTaaS
Strix (autonomous PTaaS)
Human-led PTaaS
Strix (autonomous PTaaS)
Human-led PTaaS
Strix (autonomous PTaaS)
Human-led PTaaS
Strix (autonomous PTaaS)
Human-led PTaaS
Strix (autonomous PTaaS)
Human-led PTaaS
Strix (autonomous PTaaS)
Human-led PTaaS
Strix (autonomous PTaaS)
Human-led PTaaS
Strix (autonomous PTaaS)
Human-led PTaaS
From issue to fix in seconds
Find critical issues, auto-validate, and auto-fix with merge-ready PRs.
SSRF via URL Parameter in /api/proxy
TL;DR
The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.
Impact
Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.
Location
acme/api · proxy-handler.ts:23Severity
CVSS
8.6Fix Effort
LowDiscovered
2h agoDiscover & Validate
Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.
How do I fix it?
Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.
| 23 | 23 | const targetUrl = req.query.url; |
| 24 | const resp = await fetch(targetUrl); | |
| 24 | const parsed = new URL(targetUrl); | |
| 25 | if (!ALLOWED_HOSTS.has(parsed.hostname)) { | |
| 26 | throw new ForbiddenError("blocked"); | |
| 27 | } | |
| 28 | const resp = await fetch(parsed.href); | |
| 25 | 29 | return res.json(await resp.json()); |
Auto-Fix
Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.
Frequently asked questions
Common questions about penetration testing as a service.
Keep exploring
Solutions
Start testing in minutes
Continuous pentesting as a service, validated findings, merge-ready fixes, and evidence for every audit.