use cases · startups
Penetration testing for startups
No security team yet, a launch coming up, and a customer's security questionnaire asking about your last pentest. Xalgorix runs an autonomous, exploit-verified pentest of your app from $10, so you can test before launch and after every release, and fix what it proves before anyone else finds it.
How startups use it
01 · Before launch
Scan everything that's public
A Wildcard scan enumerates your subdomains and tests each live host (1 credit per live host) with the full 22-phase methodology: recon, directory discovery, auth and session testing, injection, IDOR, SSRF and more. Forgotten staging hosts and exposed files are exactly what it looks for.
02 · Every pull request
Free security review on the diff
The GitHub App reviews each pull request's changed code for injection, broken access control, SSRF and leaked secrets, and comments on the PR. It's free and needs no account, API key or workflow file.
03 · Every release
Re-test what shipped
Run a scan after a release, or schedule recurring scans and wire Xalgorix into CI with the GitHub Action, REST API and webhooks (scheduling and CI/CD integrations are on the Pro and Max plans).
04 · When a customer asks
Share evidence they can check
Every finding comes with the request, the response and the steps to reproduce it. Share a report as a PDF or a link you can revoke; Pro adds custom-branded PDFs and password-protected links.
Compliance: what an automated pentest covers
SOC 2 has no explicit penetration-testing requirement, but a pentest is a common way to support the monitoring criteria, and many auditors and enterprise buyers expect a recent one.
PCI DSS v4.0.1 does require one: Requirement 11.4 calls for internal and external penetration testing at least every 12 months and after significant changes, performed by a qualified internal resource or a qualified external third party with organizational independence.
Xalgorix gives you dated, exploit-verified findings with the evidence to reproduce each one, which is useful between formal tests and as supporting evidence. Whether it satisfies a specific requirement is your auditor's or customer's call, so ask before you rely on it.
What it won't do
- It tests what it can reach from the outside, plus the authenticated areas you give it test accounts for. It doesn't review your cloud configuration, your laptops or your vendors.
- Business-logic flaws specific to your product, and judgement about what matters most to your business, still benefit from an experienced human.
- If a customer, auditor or framework requires a test performed by an independent firm, an automated scan doesn't replace it. Use Xalgorix to find and fix issues continuously, so that test isn't the first time anyone looks.
Questions
Does SOC 2 require a penetration test?
Not explicitly. The Trust Services Criteria don't mandate one, though penetration testing is listed among the kinds of separate evaluation that can support the monitoring criteria (CC4.1). In practice many auditors and enterprise customers expect a recent test. Ask your auditor what evidence they want before you plan around it.
We take card payments. What does PCI DSS ask for?
PCI DSS v4.0.1 (Requirement 11.4) requires internal and external penetration testing at least once every 12 months and after significant changes, by a qualified internal resource or a qualified external third party with organizational independence, plus retesting of exploitable findings. Confirm the scope with your QSA or acquirer.
Is an AI pentest as good as hiring a pentest firm?
They're good at different things. Xalgorix is fast, cheap enough to run on every release, and only reports findings it could exploit. A good human tester brings judgement on business logic and context. Many startups run Xalgorix continuously and commission a human-led test when a customer or audit calls for one.
Is it safe to run against production?
Payloads are non-destructive and request rates are capped, but we still recommend pointing the first scans at staging. Only scan systems you own or have written permission to test.
What does it cost?
Credit packs start at $10 for 10 credits and never expire. A single-target scan uses 1 credit, or 2 on heavy targets. Plans start at $49 a month, and the open-source engine is free to self-host with your own model key.
Sources: Cloud Security Alliance: SOC 2 Reports and Penetration Tests; PCI Security Standards Council document library (PCI DSS v4.0.1). This page is general information, not legal or audit advice.
Find it before your customers do
10 credits for $10, no subscription, and credits never expire. Or self-host the open-source engine for free.