Α
The watchman
Hera set Argus Panoptes to guard Io. He had a hundred eyes, and only two ever slept at once.
Panoptes keeps watch the same way: something is always scanning, release after release.
Autonomous security testing for web apps
A hundred eyes.Never all asleep.
Autonomous pentests that prove what's exploitable, plus continuous scanning across your code, containers, cloud and attack surface. Every scan runs only on assets you've verified you own, and every finding comes with evidence.
01/
Continuous, not annual.
Scanning runs with every release; pentests on demand.
02/
Proof, not noise.
Every finding is validated with evidence.
03/
Scoped and safe.
Only assets you've verified you own.
[Works with your stack]
AWSGoogle CloudAzureKubernetesDockerCloudflareGraphQLOpenAPIOktaAuth0KeycloakJWTSupabaseTerraformGitHub
You ship every day. You test once a year.
The annual pentest
- Weeks to scope and schedule a test.
- Five figures for a point-in-time snapshot.
- A PDF that's stale the day it arrives.
- Nothing watching your code, cloud or images in between.
Panoptes
- Verify an asset once and scanning starts in minutes.
- Code, containers, cloud and surface watched continuously.
- An autonomous pentest proves what's actually exploitable.
- Every finding ships with evidence and fix guidance.
[Why the name]
Πανόπτης.
Argus Panoptes, the hundred-eyed watchman of Greek myth, painted on Athenian red-figure vases in the fifth century BC.
Β
The lullaby
Hermes didn't overpower Argus. He played the pipes and told stories until every eye closed.
Breaches happen in the gap after the annual test, when everyone stops looking. We close that gap.
Γ
The peacock
Hera kept the hundred eyes and set them in the peacock's tail, so nothing they saw was lost.
Every finding is kept with its evidence, so you can show auditors exactly what was tested.
[Platform]
One verified asset pool. Five ways to watch it.
The Attack engagement, scoped with our team: an agent-driven red team reasons across access control, tenant isolation and business logic to find what's exploitable, then validates each path through the Proof Loop. Live exploitation is human-gated, so you get reproduction steps, not a list of maybes.
Outcome: Reproduction steps for the flaws that actually chain.
Proof LoopAccess controlBusiness logic
[Products]
One asset pool. Five products over it.
Register an asset and prove you own it once. Every product is a lens over that one verified pool: the autonomous pentest and four continuous scanners, all feeding a single findings feed.
Verified ownership
Nothing is scanned or tested until you've proven you own it. Ownership is bound to the exact asset and surface, so you register once and reuse it everywhere.
The Proof Loop
No finding without evidence. Every result links a stored, masked proof artifact with reproduction steps, not a backlog of maybes.
01/Human-gated
Autonomous Pentest
Agent-driven exploitation, proven through the Proof Loop
Engines
Panoptes agentrecon-to-exploit chainZAP (active)
The Attack engagement, scoped with our team. An agent-driven red team works across your in-scope verified assets, chaining access-control, tenant-isolation and business-logic flaws to find what's actually exploitable. Live exploitation is human-gated, so you get reproduction steps and stored evidence. Priced by scope, never per asset.
What it covers
- Access control & tenant isolation
- Business-logic abuse & workflow chains
- Multi-step exploit paths across surfaces
- Verified-pentest scope bands + estimator
02/Continuous · read-only
Code Scanning
Repos: SCA, Secrets, SAST, IaC, SBOM & malware
Engines
TrivyOSV-ScannerGitleaksSemgrepCheckovSyftGuardDog
Connect a repository and Panoptes watches every push: vulnerable dependencies, leaked secrets, insecure code, infrastructure-as-code misconfig, a full SBOM and malicious packages. One read-only pass, prioritised by reachability and CISA KEV.
What it covers
- SCA: dependency CVEs, reachability-ranked
- Secrets: leaked keys & tokens (masked)
- SAST: insecure code, OWASP/CWE mapped
- IaC misconfig · SBOM · malicious packages
03/Continuous · read-only
Container Scanning
Image CVEs, EOL base images, SBOM & malware
Engines
Trivy imageGrypeSyftGuardDog
Connect a registry (ECR) or ingest AWS Inspector findings, then scan image layers for known CVEs across OS and application packages, flag end-of-life base images, generate an SBOM and catch malicious packages — each re-scored by how the image is actually deployed.
What it covers
- Layer-by-layer OS + app CVEs
- Registry (ECR) connect + Inspector ingest
- End-of-life base image detection
- Per-image layers, licenses & EOL detail
- CycloneDX / SPDX SBOM export
- Malicious package detection
04/Continuous · agentless
Cloud & VM
CSPM + VM posture across AWS, Azure & GCP
Engines
ProwlerScoutSuiteTrivy vm
Connect AWS in one click with CloudFormation, then an agentless, read-only review of your cloud configuration: exposed services, over-broad IAM and risky defaults, plus snapshot-based VM scanning. Every check maps to a compliance control — SOC 2, ISO 27001, PCI DSS, HIPAA, CIS or NIST — and is re-scored by real exposure.
What it covers
- CSPM misconfig & over-permissioned IAM
- One-click AWS connect (CloudFormation)
- Public exposure & risky defaults
- Snapshot VM package CVEs
- Each check mapped to a control
- SOC 2 · ISO 27001 · PCI · HIPAA · CIS · NIST
05/Passive = watch · active = gated
Surface & DAST
Discover what you expose, then test it
Engines
subfinderhttpxtlsxnucleikatanaZAP
Discover the domains, hosts and services you actually expose, including the ones nobody remembers deploying. Watch them for change and run passive web/API checks on the continuous cadence. Active DAST and the deep agentic scan stay behind a per-run authorization.
What it covers
- Subdomain & host discovery, change alerts
- Passive headers, TLS, exposed-lib CVEs
- Active REST/GraphQL fuzzing (gated)
- Deep agentic scan (the pentest)
[Integrations]
Findings land where you already work.
Every validated finding is pushed to the tools your team and your auditors already live in — issue trackers, chat, GRC and your own endpoints. No separate console to babysit.
Issue tracking
- GitHub
- Linear
- ClickUp
- ServiceNow
Chat
- Slack
- Microsoft Teams
Compliance (GRC)
- Vanta
- Drata
Custom
- Webhooks
Nine delivery connectors today, with more on the roadmap.
[How it works]
Verify. Watch. Prove.
Register an asset and prove you own it once. Panoptes then scans it continuously and runs an autonomous pentest on demand. Every finding is validated with evidence before it reaches you, never a list of maybes.
Feed · samplerun 14 / continuous
Validated
23
Critical
02
In scope
48 assets
- PAN-142Cross-tenant read on /api/invoicesCritical
- PAN-138Malicious npm package in build (typosquat)Critical
- PAN-136Admin action reachable by member roleHigh
- PAN-131AWS key leaked in git historyHigh
- PAN-127Storage bucket publicly listableMedium
Verify
Register an asset (a repo, image, cloud account or domain) and prove ownership once. Nothing is scanned until it's verified. That's non-negotiable.
Watch
Passive scanners run continuously across your code, containers, cloud and surface. Active exploitation and deep pentests run only under a signed, per-run authorization. Every action is logged.
Prove
Validated findings land in one feed with severity, reproduction steps, fix guidance and stored evidence, ready for your issue tracker and your auditors.
[Where to start]Start free
Scan first. Attack when you need it.
Scan
Free on CodeContinuous scanning, from $0
Start with free code scanning, then grow coverage across containers, cloud and surface. Read-only, continuous assurance, never per asset.
- Free on Code, forever
- Code · Containers · Cloud · Surface
- Findings in your issue tracker
- Read-only, continuous
Attack
SubscriptionAutonomous pentest + scanning
Add the Proof Loop: an autonomous pentest with human-gated live exploitation that proves what's exploitable. All scanning is included.
- Everything in Scan
- Autonomous pentest runs
- Validated findings + reproduction
- Human-gated live exploitation
Verified Pentest
One-off · from $5,000Priced by scope, never per asset
A one-time, exploit-validated deep engagement across your in-scope verified assets, delivered through the Proof Loop with reproduction steps.
- Deep validated exploit chains
- Audit-ready report
- Free re-test of fixes (30 days)
- Scope bands, never per asset
Not ready to connect a repository? Verify a web target and run one free Proof.
[Pricing]Most picked
Scan cheap. Attack when you need it.
Start scanning for free on your code, then grow coverage across containers, cloud and surface. Code scanning starts after you connect a repository (GitHub is the fastest path); free Proof starts by verifying a web target. Add the autonomous pentest, the Proof Loop, when you need proof of what's exploitable. Priced per org and per run, never per asset.
Per org, per run
Pay for the workspace and the pentest runs you use — never per asset.
Free to start
Free Code scanning and one free Proof on a verified web target. No card, no sales call.
Proof-backed
Every paid finding ships with reproduction steps and stored evidence, not a maybe.
Save 15%
Scan my codeStart free, then add containers, cloud and surface as you grow.Pentest continuouslyAdd autonomous pentest runs to any Scan plan, or choose Attack.One deep testA one-time Verified Pentest, priced by scope.
Scan · continuous scanning
Breadth and continuous assurance. Read-only scanners across your verified assets, included by product and cadence. No autonomous pentest here; add Attack-Run credits for the occasional one.
Scan Free
Weekly$0forever
Code
Best for: First code scan, solo projects
The wedge: free code scanning so you can see what's in your repos before you pay a cent.
- Code scanning: SCA · Secrets · SAST · IaC · SBOM · Malware
- Weekly cadence
- Free forever · fair-use caps
- No card required
Scan Starter
Daily$350/ month
Code + Containers
Best for: Small teams adding containers
Code and container scanning on a daily cadence, with findings in your issue tracker.
- Code + Container scanning
- Daily cadence
- KEV-first prioritization
- Findings in your issue tracker
Scan Growth
Daily$900/ month
+ Cloud
Best for: Teams adding cloud posture
Add cloud posture (CSPM + VM), each check mapped to a compliance control.
- Code + Containers + Cloud
- Daily cadence
- Compliance-mapped findings
- Real-time finding stream
Scan Scale
Continuous$2,500/ month
All four scanners (+ Surface)
Best for: Security teams covering the full estate
The estate-wide watch: every scanner, including surface discovery and passive DAST, continuously.
- Code + Containers + Cloud + Surface
- Continuous cadence
- Surface discovery & passive DAST
- Audit-ready evidence trail
Attack · autonomous pentest
The Proof-Loop differentiator. Autonomous pentest with human-gated live exploitation that proves what's actually exploitable, with all continuous scanning included.
Attack Starter
4 runs / month$1,500/ month
Pentest + all scanning
Best for: Teams starting continuous pentesting
Autonomous pentest on your verified assets, with every scanner included underneath.
- Everything in Scan
- 4 autonomous pentest runs / month
- Proof Loop: validated + reproduction
- Human-gated live exploitation
Attack Growth
12 runs / month$3,500/ month
Pentest + all scanning
Best for: Teams shipping every week
Continuous pentest across surfaces, with every deploy, not once a year.
- Everything in Scan
- 12 autonomous pentest runs / month
- Multi-surface attack paths
- Real-time finding stream
Attack Scale
30 runs / month$7,500/ month
Pentest + all scanning
Best for: Estates that need daily assurance
Daily autonomous assurance across the estate, with credits to burst when it matters.
- Everything in Scan
- 30 autonomous pentest runs / month
- Custom cadence & SLA
- Priority support
Verified Pentest · one-time
A one-time, exploit-validated deep engagement across your in-scope verified assets, priced by scope band, never per asset.
Standard
One-off$5,000/ pentest
1 surface
Best for: One web app, API or cloud account
A full validated pentest on a single surface: web app, API or cloud account.
- Validated findings with PoC
- Audit-ready report
- Re-test after fixes (30 days)
Large
One-off$12,000/ pentest
1 complex surface
Best for: A complex single surface
Deeper exploitation for complex, high-surface-area single-surface scopes.
- Everything in Standard
- Multi-step attack chains
- Business-logic testing
Multi-surface
One-off$25,000/ pentest
2+ surfaces
Best for: Several surfaces under one engagement
Multiple surfaces under one authorization, with cross-surface attack paths.
- Everything in Large
- Cross-surface attack paths
- Executive readout
Attack-Run credits
On any Scan plan and need the occasional pentest? One credit buys one autonomous pentest run. Credits stay usable until used.
- 1 run · $500
- 10 runs · $4,500
- 50 runs · $20,000
If a pentest run validates nothing exploitable, we'll review the run with you and discuss a re-run or credit.
Per org, per run, never per asset. Prices in USD, excluding taxes. Annual billing saves 15%.
Is there a trial?
No trial. Start with a free Code scan and one free Proof on a verified web target, then upgrade when you need more.
Do I need a credit card?
No for the free Code scan or the free Proof. Paid Scan and Attack plans check out through Stripe.
What counts as an autonomous pentest run?
One run of the Proof Loop against your in-scope verified assets under the signed authorization.
How long do Attack-Run credits last?
They stay usable until used.
[Next step]Find it before
Find it before
they do.
Panoptes is live. Connect a repository (GitHub is the fastest path) for a free Code scan, or verify a web target to run a free Proof. Attack and Verified Pentest are scoped with our team.
Start freeor write to contact@pnpts.com