See what an AI attacker finds on your perimeter, for free
Traditional pen tests cost thirty grand, take six weeks to book, and are out of date the next afternoon when your team deploys. Automated scanners are worse: they hand you 400 unverified alerts and leave your engineers to sort out which ones matter. Send us a written email approving the test and accepting the minor risk, and we will run an AI pen test against your external footprint for free.
Why most security testing sits in a drawer
Almost every technology lead we speak to has a PDF from last year’s penetration test sitting in a shared drive. The report is eighty pages long, half of it is boilerplate about TLS ciphers, and the three things that could actually get the company breached are buried on page forty-two.
Attackers are already using AI agents to map public infrastructure and probe APIs continuously. Defending against that with an annual manual check makes no sense.
Our AI pen test agents do the reconnaissance and validation work an experienced offensive engineer does, at machine speed:
Finds what was left behind
Most breaches do not come through your hardened front door. They start on a forgotten staging server, an old marketing site, a dangling DNS record or a temporary storage bucket that someone stood up outside Terraform two years ago and never turned off.
Probes web apps, APIs and leaked secrets
The agents inspect live services for exposed .env and .git files, open Swagger and GraphQL schemas, broken authentication, CORS mistakes, SSRF, injection flaws and unpatched edge appliances.
Chains findings instead of listing CVEs
A low-severity config leak in one place and a permissive API endpoint in another look harmless in isolation. Our agents test whether those pieces fit together into an actual attack path before bothering you with them.
Reviewed by an engineer before you see it
We do not forward raw tool output. One of our security engineers checks the results, strips out noise, and writes up what is actually exposed and how to fix it.
What we need from you before we run it
We will not run a pen test off a web form. Anyone can type someone else’s URL into a form on the internet, and any security firm that starts probing infrastructure without verifying who asked for it is reckless.
To kick off the free AI pen test, you need to send us an email from your work address doing two things:
- Approving us in writing to run the pen test on behalf of your organisation.
- Accepting that active testing carries a minor risk. Our agents are rate-limited and non-destructive, and we never run denial-of-service traffic or data-wiping payloads. Even so, probing live services puts entries in your logs, can set off WAF or SIEM alerts, and can occasionally upset a fragile legacy service. You need to confirm in writing that you accept that minor risk.
Generate your approval email
Related security services
- Cloud Security Reviews & Audits: Two-week review of your Google Cloud IAM, network boundaries, encryption and regulatory posture.
- Wiz Deployment & Remediation: Agentless internal cloud posture mapping and Terraform remediation with an Elite Wiz Partner.
- Google SecOps Implementation: SIEM and SOAR detection engineering on Google SecOps with custom YARA-L rules.
- Managed Agentic SOC: 24/7 alert triage and incident response built on Google SecOps and Gemini agents.
- Unblock AI Workloads with Wiz and Google SecOps: Get internal AI pilots signed off by your risk and security committee.
Terms, scope and conditions (the fine print) ▼
Delivering entity: All testing under this offer is carried out by Aviato Security Pve Ltd.
Scope of testing: Unless specific exclusions are listed in your written approval email, the test covers your nominated primary domain and all discoverable subdomains associated with it, including public web applications, APIs, DNS records and TLS endpoints reachable from the public internet.
Written authorisation and verification: We do not begin testing until we receive an email from a corporate address matching the target organisation, sent by an officer or employee with authority to permit security testing, and we have confirmed the testing window in writing. We verify sender authenticity via SPF, DKIM and DMARC and may request a DNS TXT record or phone confirmation where ownership of a target asset is unclear.
Acceptance of minor operational risk: Testing uses rate-limited, non-destructive AI agents and excludes volumetric denial-of-service (DoS/DDoS) attacks, social engineering, physical security testing and intentional data destruction. Even so, active probing sends real traffic and payloads to live systems and carries a minor risk of triggering WAF/IDS/SIEM alerts, generating test entries in unauthenticated forms or webhooks, or disrupting fragile or under-resourced legacy services. By requesting the test, your organisation accepts this minor risk and agrees to notify any internal SOC or third-party hosting provider as needed.
Third-party and shared infrastructure: Testing is restricted to assets owned or controlled by your organisation. We do not test third-party SaaS platforms where you do not control the underlying host, other than checking your public DNS and configuration boundary.
Eligibility and limits: Limited to one free AI pen test per commercial organisation in any 12-month period. We reserve the right to decline or stop a test at our discretion. The report is provided free of charge on an "as-is", point-in-time basis, carries no warranty that every vulnerability has been found, and does not constitute a formal compliance certification or contractual audit.
Questions we get asked
What is an AI pen test, and how is it different from a vulnerability scanner?
A traditional vulnerability scanner fires a static list of signatures and hands you a 300-page PDF full of unverified warnings and false positives. Our AI pen test agents inspect how your live web applications and APIs respond, test whether exposed credentials or misconfigurations can actually be chained together, and only report findings that represent a real path in.
Why is it free?
Most organisations already have a shelf of security reports they paid $30,000 for and never had the engineering time to fix. Running the initial AI pen test for free lets us show you concrete, verified findings in a couple of days rather than pitching you a slide deck. If everything comes back clean, you owe us nothing. If we find problems you want help fixing in Terraform or your application code, you know where we are.
Why do I have to send an email instead of filling in a web form?
Anyone can type a competitor's company name into a web form. Because a penetration test sends real traffic to live infrastructure, we need an email sent from your corporate work address confirming in writing that you approve us running the test and that you accept the minor operational risk involved. Your email headers (SPF, DKIM and DMARC) let us verify that the request came from your organisation.
What does 'accepting a minor risk' mean in practice?
We rate-limit our agents, we do not run denial-of-service traffic, and we do not run payloads that delete data. Even so, active testing sends real requests and input probes to your public endpoints. That can trigger alerts in your WAF or SIEM, leave test entries in unauthenticated forms, or trip over a fragile legacy server that nobody has touched in years. Standard pen testing practice is that you acknowledge and accept that minor risk in writing before a single packet is sent.
What do we get at the end of the test?
A concise engineering report listing the verified exposures we found, the evidence showing how each one works, and the steps to close them. There is no filler, and if you want a 20-minute call with one of our security architects to walk through the findings, we will set that up.
Talk to an architect who has done this before.
Bring your current setup and the outcome you need. You will get a view on the approach, the risks and roughly what it costs.
Straight to a senior GCP architect. No SDR, no slide deck.
Not ready to talk? See how we migrated Hapana off AWS →
Or call +61 2 8359 9507 · Hello@aviato.consulting