Attack Surface
FREE€0no signup · 60 seconds
See what an attacker can see about you from the outside.
- Every internet-facing asset of yours
- Indicators only, nothing is attacked
Autonomous Pentesting in 24 Hours
We test your web app and APIs the way a real attacker would, prove what is really exploitable, and hand you the report auditors ask for. In 24 hours, with or without your source code.
Or book a demo with our team →24h
Full pentest
Zero
False positives
Top-pentester
Quality levelmatches the best human pentester, in benchmarks
Monthly
Evidence refresheda full pentest every month with Professional
squr.ai/one-finding
Illustrative run
Trusted by security-first teams across Europe
Built in Europe · Research collaboration with the Karlsruhe Institute of Technology (KIT)
Why teams come to SQUR
Sound familiar?
Most teams start with one of these three situations.
A customer asked for a pentest report
Your first enterprise customer or a partner wants proof that your app has been tested. Get a report auditors accept in 24 hours, at a fixed price instead of 4–6 weeks and €10k–30k.
See the pentestNIS2, DORA or ISO 27001 asks for regular testing
Keep your evidence current with a full pentest every month, instead of one report that is stale the day it arrives.
NIS2DORAISO 27001SOC 2BSIGDPR
See Professional
You ship every week
Test new features as they ship. Every finding comes with a step-by-step fix, and the retest is included.
For engineering teams
In plain words
Your web apps and APIs are like houses. Here is how we make them safe.
No security background needed: four steps, one picture.
YOU GETA list of every internet-facing asset of yours: domains, subdomains and services. Indicators only, nothing is attacked.
-
Attack Surface
See every house you own
We look at your digital property from the street, like any stranger could, and list every house that belongs to you, including the forgotten ones. We only look. We never touch anything.
See your attack surface -
Pentest
Pick one house. We try every way in.
With your permission, our AI tests every door and window of that web app or API like a real attacker would: with the key, a lockpick, a crowbar. It keeps a photo of everything that really opens. With your blueprints (your source code) it checks inside the walls too.
How the pentest works -
Autonomous Remediation
Get the repair, not just the alarm
For every open door you get a ready-made repair, so your team only has to review and approve it. Then we try the door again.
About the beta -
Continuous Pentesting
Check again every month
Every new feature is a new door. Each month we test the house again, so your proof never goes out of date.
See Professional
Your part is small: a URL and a yes. No security expertise needed.
Why it is different
Verified exploitability. Not just detection.
Traditional scanners flood your backlog. An independent verifier re-tests findings against the live app, and SQUR marks any it could not confirm.
Real exploitation, not detection
SQUR actually exploits vulnerabilities and proves them: a working exploit for every confirmed finding, not a list of maybes.
An independent second check
A separate agent re-tests every finding against the live app, so you get labelled, deduplicated results instead of scanner noise.
A fix and a retest, included
Step-by-step remediation for every finding, and a free retest to confirm the fix works.
| Vulnerability scanner | Traditional pentest | SQUR | |
|---|---|---|---|
| Proof for every finding | No, it flags possible issues | Yes | Yes, a working exploit |
| Results in | Minutes | 4–6 weeks | 24 hours |
| Price | Subscription | €10k–30k | €1,995, or €995 a month |
Under the hood · for security teams
- Coverage
- OWASP Top 10, OWASP API Security Top 10 and the Web Security Testing Guide: SQLi, XSS, SSRF, XXE, IDOR/BOLA, business logic and more.
- Mappings
- Every finding mapped to CWE, CVE where applicable, CAPEC and MITRE ATT&CK, with a clear risk level.
- Reports
- Two reports from one engagement: a shareable Attestation Summary and a Detailed Report with evidence screenshots. PDF and in-app.
- Compliance
- Reports support GDPR, DORA Article 24, ISO 27001, SOC 2 and NIS2. A shareable certificate for a pentest with no high or critical findings.
- Automation
- CI/CD integration and a public API on the Enterprise plan.
Pentest Benchmark Results
A top pentester's quality, in 24 hours
Benchmarked against the best human pentester in the field, SQUR matched their quality and returned the result in 24 hours instead of weeks. Automated triage at human-equivalent precision.
100% success on IDOR, SQLi, SSRF, XXE, GraphQL, and Business Logic challenges.
Real-world results
Case studies
High Severity - Confirmed
Found in 5 min 30 s
Finding What Scanners Miss: Self-Verification Bypass
SQUR discovered a mass assignment vulnerability that traditional scanners overlooked. 2 agents confirmed the finding, mapping 4 exploitable fields.
Read case study arrow_forward
False Positive - Rejected
Rejected in 3 min 26 s
Catching Its Own Mistakes: Disproving a Finding
SQUR automatically disproved a JSON Parameter Pollution false positive through 8 test variations, preventing wasted engineering time.
Read case study arrow_forwardWhat our customers say
"SQUR made security testing refreshingly simple. It uncovered issues we didn't even realize were there - fast, clear, and without the usual stress of pentesting. We were genuinely impressed with the results. Highly recommended."
Marcel Hartmann
Head of IT, Gameforge 4D GmbH
"SQUR is super easy to set up and the pentest report is ready next day. The free retest is a sweet thing. Pentesting must not be once a year anymore."
Juri Kuehn
CEO, Codeligence GmbH
"At bitExpert, we manage multiple projects simultaneously. Tools that optimize our workflows are invaluable. By reducing pentest costs and increasing speed, we can ensure security without delaying development - a significant advantage for our team."
Stephan Hochdörfer
Head of IT Business Ops, bitExpert AG
Recognized across Europe
Simple, fixed pricing
Start free. Pay when you want proof.
A traditional pentest costs €10k–30k and takes 4–6 weeks. SQUR has fixed prices and results in 24 hours.
Pentest
€1,995one-time
One full pentest of one web app or API.
- Results in 24 hours
- A working exploit for every confirmed finding
- Black-box, or whitebox with your code at no extra cost
- A report auditors accept, free retest
Professional
€995per app, per month
A full pentest every month, so your evidence stays current.
- Re-tests your open findings each month
- Certificate refreshed on a clean result
- Alerts when something new appears
- Cancel anytime
Autonomous Remediation
BETAPrivate betaby application
Pentest and fix in 24 hours.
- Every confirmed finding arrives as a pull request
- With the fix and a regression test
- Your team reviews and merges
- Works with GitHub
All prices exclude VAT. Any VAT due depends on your location and VAT status. Free trial and bulk credits available.
Questions
Questions teams ask first
What do I have to provide?
A target URL and a scope, plus optional logins for one or more user roles. Source code is optional: with it, SQUR also runs a whitebox pentest at no extra cost.
Is it safe to run against my live app?
Testing uses non-destructive techniques, all automated activity is rate-limited with configurable throttling, and production environments can specify additional safeguards. A dedicated agent enforces your scope before every action.
Who decides what gets tested?
You do. A test starts only after you prove control of the target with a DNS TXT record and record the exact scope you authorize. Testing never extends beyond that scope.
Where is my data stored?
Test data, findings and reports are stored in the EU (Brussels).
How does SQUR compare to a traditional pentest firm?
Traditional pentest firms charge €10k–30k, take 4–6 weeks, and deliver a PDF you read once. SQUR delivers verified findings in 24h at €1,995, with proof-of-exploit for every confirmed finding, so your team knows exactly what to fix and in what order.
What's included in a Compliance pentest?
A live autonomous pentest covering web & API surfaces, compliance-ready reports (ISO 27001, SOC 2, CRA), detailed remediation instructions for every finding, and free retesting to confirm your fixes work. Upload your source code and the pentest also uses it (white-box), at no extra cost.
What if SQUR doesn't find any vulnerabilities?
You still get a full compliance-ready report documenting what was tested and confirmed clean - which is exactly what auditors and customers ask for.
How does payment work?
We use Stripe for secure payment processing. You can purchase directly in the platform with no auto-renewal.
What does the Free Trial include?
Create your pentest setup and explore key flows. No credit card required.
How do Bulk credits work?
Purchase 10 pentest credits at a 25% discount. Credits are valid for 12 months and can be used at any time.
Ready to test your web app and APIs?
First results in 24 hours. No security expertise needed. A fixed price, with the retest included.
Not ready? See what attackers can see about you first.