Α
The watchman
Hera set Argus Panoptes to guard Io. He had a hundred eyes, and only two ever slept at once.
→ Panoptes keeps watch the same way: something is always scanning, release after release.
Autonomous security testing for web apps
A hundred eyes.Never all asleep.
Autonomous pentests that prove what's exploitable — plus continuous scanning across your code, containers, cloud and attack surface. Only on assets you've verified you own, with evidence for every finding.
01/
Continuous, not annual.
Scanning runs with every release; pentests on demand.
02/
Proof, not noise.
Every finding is validated with evidence.
03/
Scoped and safe.
Only assets you've verified you own.
[Works with your stack]
AWSGoogle CloudAzureKubernetesDockerCloudflareGraphQLOpenAPIOktaAuth0KeycloakJWTSupabaseTerraformGitHub
You ship every day. You test once a year.
The annual pentest
- Weeks to scope and schedule a test.
- Five figures for a point-in-time snapshot.
- A PDF that's stale the day it arrives.
- Nothing watching your code, cloud or images in between.
Panoptes
- Verify an asset once — scanning starts in minutes.
- Code, containers, cloud and surface watched continuously.
- An autonomous pentest proves what's actually exploitable.
- Every finding ships with evidence and a fix.
[Why the name]
Πανόπτης.
Argus Panoptes, the hundred-eyed watchman of Greek myth, painted on Athenian red-figure vases in the fifth century BC.
Β
The lullaby
Hermes didn't overpower Argus. He played the pipes and told stories until every eye closed.
→ Breaches happen in the gap after the annual test, when everyone stops looking. We close that gap.
Γ
The peacock
Hera kept the hundred eyes and set them in the peacock's tail, so nothing they saw was lost.
→ Every finding is kept with its evidence, so you can show auditors exactly what was tested.
[Platform]
One verified asset pool. Five ways to watch it.
AI agents reason like a red team and prove what's exploitable — access control, tenant isolation, business logic — then validate it through the Proof Loop. Live exploitation is human-gated; you get reproduction steps, not a list of maybes.
Proof LoopAccess controlBusiness logic
[Products]
One asset pool. Five products over it.
Register an asset and prove you own it once. Every product is a lens over that one verified pool — the autonomous pentest and four continuous scanners — all feeding a single findings feed.
Verified ownership
Nothing is scanned or tested until you've proven you own it. Ownership is bound to the exact asset and surface — register once, reuse everywhere.
The Proof Loop
No finding without evidence. Every result links a stored, masked proof artifact — reproduction steps, not a backlog of maybes.
01/Human-gated
Autonomous Pentest
Agent-driven exploitation, proven through the Proof Loop
Engines
Panoptes agentrecon → exploit chainZAP (active)
The Attack product. AI agents reason like a red team across your in-scope verified assets — chaining access-control, tenant-isolation and business-logic flaws — and prove what's actually exploitable. Live exploitation is human-gated; you get reproduction steps and stored evidence, priced by scope and never per asset.
What it covers
- Access control & tenant isolation
- Business-logic abuse & workflow chains
- Multi-step exploit paths across surfaces
- Verified-pentest scope bands + estimator
02/Continuous · read-only
Code Scanning
Repos: SCA, Secrets, SAST, IaC, SBOM & malware
Engines
TrivyOSV-ScannerGitleaksSemgrepCheckovSyftGuardDog
Connect a repository and Panoptes watches every push. Vulnerable dependencies, leaked secrets, insecure code, infrastructure-as-code misconfig, a full SBOM and malicious packages — one read-only pass, prioritised by reachability and CISA KEV.
What it covers
- SCA — dependency CVEs, reachability-ranked
- Secrets — leaked keys & tokens (masked)
- SAST — insecure code, OWASP/CWE mapped
- IaC misconfig · SBOM · malicious packages
03/Continuous · read-only
Container Scanning
Image CVEs, EOL base images, SBOM & malware
Engines
Trivy imageGrypeSyft
Scan image layers for known CVEs across OS and application packages, flag end-of-life base images, generate an SBOM and catch malicious packages — re-scored by how the image is actually deployed.
What it covers
- Layer-by-layer OS + app CVEs
- End-of-life base image detection
- CycloneDX / SPDX SBOM export
- Malicious package detection
04/Continuous · agentless
Cloud & VM
CSPM + VM posture across AWS, Azure & GCP
Engines
ProwlerScoutSuiteTrivy vm
Agentless, read-only review of your cloud configuration — exposed services, over-broad IAM, risky defaults — plus snapshot-based VM scanning. Every check maps to a compliance control and is re-scored by real exposure.
What it covers
- CSPM misconfig & over-permissioned IAM
- Public exposure & risky defaults
- Snapshot VM package CVEs
- Each check mapped to a control
05/Passive = watch · active = gated
Surface & DAST
Discover what you expose, then test it
Engines
subfinderhttpxtlsxnucleikatanaZAP
Discover the domains, hosts and services you actually expose — including the ones nobody remembers deploying — watch them for change, and run passive web/API checks on the continuous cadence. Active DAST and the deep agentic scan stay behind a per-run authorization.
What it covers
- Subdomain & host discovery, change alerts
- Passive headers, TLS, exposed-lib CVEs
- Active REST/GraphQL fuzzing (gated)
- Deep agentic scan (the pentest)
[How it works]
Verify. Watch. Prove.
Register an asset and prove you own it once. Panoptes then scans it continuously and runs an autonomous pentest on demand — and every finding is validated with evidence before it reaches you. Not a list of maybes.
Feed · samplerun 14 / continuous
Validated
23
Critical
02
In scope
48 assets
- PAN-142Cross-tenant read on /api/invoicesCritical
- PAN-138Malicious npm package in build (typosquat)Critical
- PAN-136Admin action reachable by member roleHigh
- PAN-131AWS key leaked in git historyHigh
- PAN-127Storage bucket publicly listableMedium
Verify
Register an asset — a repo, image, cloud account or domain — and prove ownership once. Nothing is scanned until it's verified. That's non-negotiable.
Watch
Passive scanners run continuously across your code, containers, cloud and surface. Active exploitation and deep pentests run only under a signed, per-run authorization. Every action is logged.
Prove
Validated findings land in one feed with severity, reproduction steps, fix guidance and stored evidence — ready for your issue tracker and your auditors.
[Where to start]Start free
Scan first. Attack when you need it.
Scan
Free on CodeContinuous scanning, from $0
Start cheap — free code scanning — and grow coverage across containers, cloud and surface. Read-only, continuous assurance, never per asset.
- Free on Code, forever
- Code · Containers · Cloud · Surface
- Findings in your issue tracker
- Read-only, continuous
Attack
SubscriptionAutonomous pentest + scanning
Add the Proof Loop: autonomous pentest with human-gated live exploitation, proving what's exploitable — and all scanning is included.
- Everything in Scan
- Autonomous pentest runs
- Validated findings + reproduction
- Human-gated live exploitation
Verified Pentest
One-off · from $5,000Priced by scope, never per asset
A one-time, exploit-validated deep engagement across your in-scope verified assets — delivered through the Proof Loop with reproduction steps.
- Deep validated exploit chains
- Audit-ready report
- Free re-test of fixes (30 days)
- Scope bands, never per asset
[Pricing]Most picked
Scan cheap. Attack when you need it.
Start scanning for free on your code, and grow coverage across containers, cloud and surface. Add autonomous pentest — the Proof Loop — when you need proof of what's exploitable. Per org, per run — never per asset.
Scan — continuous scanning
Breadth and continuous assurance. Read-only scanners across your verified assets, included by product and cadence. No autonomous pentest — add Attack-Run credits for the occasional one.
Scan Free
Weekly$0forever
Code
The wedge: free code scanning so you can see what's in your repos before you pay a cent.
- Code scanning — SCA · Secrets · SAST · IaC · SBOM · Malware
- Weekly cadence
- Solo / trial · fair-use caps
- No card required
Scan Starter
Daily$350/ month
Code + Containers
Code and container scanning on a daily cadence, with findings in your issue tracker.
- Code + Container scanning
- Daily cadence
- KEV-first prioritization
- Findings in your issue tracker
Scan Growth
Daily$900/ month
+ Cloud
Add cloud posture (CSPM + VM), each check mapped to a compliance control.
- Code + Containers + Cloud
- Daily cadence
- Compliance-mapped findings
- Real-time finding stream
Scan Scale
Continuous$2,500/ month
All four scanners (+ Surface)
The estate-wide watch: every scanner, including surface discovery and passive DAST, continuously.
- Code + Containers + Cloud + Surface
- Continuous cadence
- Surface discovery & passive DAST
- Audit-ready evidence trail
Attack — autonomous pentest
The Proof-Loop differentiator. Autonomous pentest with human-gated live exploitation, proving what's actually exploitable — and all continuous scanning is included.
Attack Starter
4 runs / month$1,500/ month
Pentest + all scanning
Autonomous pentest on your verified assets, with every scanner included underneath.
- Everything in Scan
- 4 autonomous pentest runs / month
- Proof Loop — validated + reproduction
- Human-gated live exploitation
Attack Growth
12 runs / month$3,500/ month
Pentest + all scanning
Continuous pentest across surfaces, with every deploy — not once a year.
- Everything in Scan
- 12 autonomous pentest runs / month
- Multi-surface attack paths
- Real-time finding stream
Attack Scale
30 runs / month$7,500/ month
Pentest + all scanning
Daily autonomous assurance across the estate, with credits to burst when it matters.
- Everything in Scan
- 30 autonomous pentest runs / month
- Custom cadence & SLA
- Priority support
Verified Pentest — one-time
A one-time, exploit-validated deep engagement across your in-scope verified assets — priced by scope band, never per asset.
Standard
One-off$5,000/ pentest
1 surface
A full validated pentest on a single surface — web app, API or cloud account.
- Validated findings with PoC
- Audit-ready report
- Re-test after fixes (30 days)
Large
One-off$12,000/ pentest
1 complex surface
Deeper exploitation for complex, high-surface-area single-surface scopes.
- Everything in Standard
- Multi-step attack chains
- Business-logic testing
Multi-surface
One-off$25,000/ pentest
2+ surfaces
Multiple surfaces under one authorization, with cross-surface attack paths.
- Everything in Large
- Cross-surface attack paths
- Executive readout
Attack-Run credits
On any Scan plan and need the occasional pentest? One credit buys one autonomous pentest run. Credits roll over for 12 months.
- 1 run — $500
- 10 runs — $4,500
- 50 runs — $20,000
Zero exploitable findings, zero cost — if a pentest run validates nothing exploitable, you don't pay for it.
Per org, per run — never per asset. Prices in USD, excluding taxes.
[Next step]Find it before
Find it before
they do.
Panoptes is live and onboarding now. Tell us about your stack and we'll get you access — or start with a free Code scan.
Start freeor write to contact@pnpts.com