AI agents test your web app, API, network or source code, overseen by humans. A second agent reproduces every finding before you see it, so the report is evidence you can hand to a SOC 2 auditor or an enterprise customer. Free unlimited retesting.
Black box $3,000 · Gray box $4,000 · White box from $7,000
24 hours counted from confirmed scope, signed rules of engagement, and test access.
Order a pentest, sign the scope, and track verified findings, reports, and retests in one portal.
See the platform ↓02 FortifyContinuous code security review. Findings validated in sandboxes, fixed in pull requests you approve.
See how issues get fixed ↓03 ProtectMonitoring, a security data lake, and continuous threat hunting across your infrastructure.
See the shield ↓Helix Cyber is where you order a pentest, sign off the scope, watch it run, and work through the results. The dashboard shows open findings by severity, what has been resolved, and how your posture has moved since the last retest.
Pick a web app, API, external network, or source-code audit, then choose black, gray, or white box. Add the domains, URLs, IP ranges, and repositories in scope. Each asset is checked for ownership before anything runs.
Your owner or admin signs the rules of engagement in the portal. The signature is bound to the exact assets, exclusions, test window, and source archive hash. No traffic is sent before it exists.
Recon, focused testing, and verification run as separate agents in sandboxed desktops on private inference. Testing is detect-only by default, with no denial of service, no brute force, and nothing destructive outside resources the test creates itself.
The agent that finds an issue is never the one that confirms it. Anything that cannot be reproduced stays a candidate and never reaches your findings list.
Findings move from reported to remediating to resolved. Mark a fix ready and the retest attacks it again, then the dashboard tracks open and resolved issues over time.
Every engagement shows where it is in the lifecycle, from draft to delivered. Assets are marked verified, the scope summary is written in plain language, and white-box source archives are pinned by SHA-256.
Each finding gets a ticket ID, severity, and status. Filter by either, open the evidence, and mark a fix ready for retest when it ships. Reports, retests, credentials, and activity sit in the tabs next to it.
This is the full report from a gray-box engagement we ran against OWASP Juice Shop, a deliberately vulnerable app, start to finish on our own platform. Sixty-seven findings, each one reproduced by a second agent before it was written up, with a request-and-response proof, a severity rationale, and a fix for every issue.
Pricing
Black box is $3,000 USD, gray box is $4,000 USD, and white box starts at $7,000 USD for a typical web app or API. Manual tests of a similar scope are commonly quoted at $8,000 to $14,000 and booked weeks out. Retesting is free and unlimited, and we confirm the scope before testing begins.
Black box
$3,000 USD
One web app or API
No internal access. We test the exposed app or API and its reachable attack surface as an external attacker would.
Free unlimited retests included.
Gray box
Usual SOC 2 choice$4,000 USD
One web app or API
Test accounts let us check access control between roles and tenants, the part auditors and enterprise customers care about most.
Free unlimited retests included.
White box
From $7,000 USD
Priced after review
Pricing depends on codebase size, repository count, dependencies, architecture, and the depth of review required.
Free unlimited retests included.
Black and gray box prices cover a typical, well-bounded single web app or API. White box pricing depends on codebase size, repository count, dependencies, architecture, and review depth. Larger applications are scoped separately. Retesting is free and unlimited. See what a web application test and an API test cover.
Larger scope? Talk to usAlso from Helix Cyber
Separate products, not part of a pentest engagement.
Continuous code security review and AI penetration testing that don’t stop at a report. Every finding is validated in a sandbox, explained, and carried through to a merged fix.
Every commit and pull request is reviewed by security agents that read your code the way an attacker would — logic flaws, injection paths, leaked secrets, broken auth. Not pattern matching. Understanding.
Findings are reproduced in sandbox desktops before you ever see them. If it can't be demonstrated, it doesn't page you — signal instead of a wall of false positives.
Severity, blast radius, and the exact code path — written for engineers and auditors alike. A continuous, compliance-ready record of your security posture.
Agents don't stop at finding issues. They write the patch, run the tests, and open a pull request. You review and merge — humans stay in the loop.
Scope testing for an audit, customer request, or internal risk review. Helix covers web applications, APIs, cloud infrastructure, networks, source code, and AI applications, not only SOC 2 evidence.
Scope reports for SOC 2 Type I or Type II, ISO 27001, PCI DSS, a customer security review, or an internal risk assessment. Each report records methodology, coverage, findings, severity, and remediation status.
Test web applications, APIs, cloud infrastructure, internal and external networks, source code, and AI or LLM applications. Agents learn how your product should work before exercising routes, roles, and permission boundaries.
Run open models on inference infrastructure you control. Your code, prompts, findings, and LLM calls are never sent to OpenAI, Anthropic, or another third-party model provider.
Agents discover what you run, wire into the monitoring you already have, and stand up a security data lake with detections built for your company — then watch it, around the clock.
Agents map your attack surface the way an intelligence organisation would — domains, services, cloud accounts, repositories, people and processes. A living picture of what needs defending.
Monitoring and alerting wired into the infrastructure you already run — Prometheus, Grafana, PagerDuty, your SIEM. No rip-and-replace. Helix envelops what exists.
A data lake for security events across your whole estate — every login, deploy, and anomaly in one queryable place. The memory your defence is built on.
Detections designed for your company, not copied from a generic rulebook — your business logic, your crown jewels, your failure modes. Alerts that mean something when they fire.
Agents watch around the clock — identifying threats as they emerge, rectifying weaknesses before they're exploited, and purging attackers who make it inside.
Security work needs models that engage with it. Helix runs powerful open models on infrastructure you control — not nerfed closed AI systems that refuse the job halfway through.
Identify threats. Rectify weaknesses. Purge attackers. An AI SOC that runs continuously — not an annual pentest report gathering dust.
Webhooks become a living security system. Events land in a queryable data lake, agents reconcile what should be true with what is true, and a coordinator spawns specialists to hunt anomalies and repel attacks in parallel.
One signal can wake a team. The coordinator keeps the work bounded, shares memory between agents, verifies the result, and turns every response into evidence for the next decision.
From $3,000, with free unlimited retests. The 24 hours start when scope, written authorization, and access are confirmed, and every finding is reproduced before it reaches your report.
