Always-on AI pentesting for your web apps and APIsAlways-on AI pentestingStart an AI pentest
Pentesting

AI Pentesting for Web Apps and APIs

Run it continuously or on demand.

Barrion tests your web apps and APIs the way an attacker would, chaining requests to find what's actually exploitable. Findings are checked against your live app before they reach the report.

Book a scoping callStart an AI pentest

A scoped engagement starts with a 30-minute call. Self-serve runs are paid in credits.

Scoped by youNon-destructiveFree retests

Hosted in Sweden. Data stored and AI processing in the EU.

See a sample pentest report
What a run costs
Light3 agents, one fast pass400 creditsNo expert review
Standard5 agents, working at once1,000 credits1 h expert review
Deep20 agents, more roles4,000 credits2 h expert review
Extended50 agents, many roles and tenants10,000 credits4 h expert review
Maximum100 agents, everything we have20,000 credits8 h expert review

Every level tests the same classes. A deeper level tests them harder. Credits come with an Essential plan (from €199/mo) or as a top-up at €0.50 a credit. Book a scoping call for discounts on larger credit orders. How credits work

Continuous pentesting

Pentest on a schedule, not once a year.

A pentest tells you where you stood on the day it ran, so test as often as you ship. Save it as a schedule, from daily to yearly, or start a run from your CI/CD pipeline through the Barrion API. Each scheduled run is compared with the last.

Catch regressions

Each scheduled run is compared with the last. If a fix breaks in a later release, it shows up as regressed, so you don't triage it again as a new finding.

Test on a schedule

Daily, weekly, monthly, quarterly, every six months, yearly, or a custom rhythm. One app can carry several schedules, say a daily Light run and a monthly Deep run.

Skip unchanged runs

You can set a schedule to skip runs when nothing changed. When it's due, we compare a snapshot of your start page's links and scripts with the last one, and if they match, that run is skipped.

Same checks every run

Findings are checked against your live app before they're reported, and anything unconfirmed is clearly marked. From Standard up, a security engineer reviews each report.

Book a scoping callStart a one-off pentest

Schedules and pipeline starts through the Barrion API are on the Business plan. Programs are priced for your apps, cadence and depth. What is continuous pentesting?

How it works

Five phases, from scope to report.

Every pentest runs in an isolated Kali sandbox, and you can follow its progress live. Here is what happens between launch and your report.

Phase 1

Scope & authorize

You approve the targets, surfaces, credentials, and any off-limits paths before a single request is sent. Thorough inside the scope, silent outside it.

Phase 2

Recon & discovery

The agent maps hosts, endpoints, parameters, auth flows, and your tech stack to build a map of the real attack surface.

Phase 3

Multi-wave testing

Specialist agents run real pentest tools across injection, access control, auth, API, and business logic, chaining findings between waves.

Phase 4

Reproduce before report

Findings we can replay are sent again against your live app. If one doesn't reproduce, it's dropped. Anything we can't replay stays in the report, marked as an unconfirmed lead.

Phase 5

Report & retest

You get a ranked report with proof, remediation, and WSTG coverage as PDF, XLSX and JSON. After you patch, a free retest checks the fix.

What we test

OWASP Top 10, API Top 10, and all 97 WSTG cases.

Broad coverage across web apps and APIs, far more than a scanner checks. Every test case maps to a WSTG ID with an evidence-backed status.

Injection & web exploitation

  • SQL & NoSQL injection
  • Cross-site scripting (XSS)
  • Command injection
  • SSRF
  • Server-side template injection
  • XML external entities (XXE)
  • CSRF
  • Open redirects

Access control & authentication

  • Broken access control
  • IDOR
  • Privilege escalation
  • Authentication & session flaws
  • JWT / token abuse
  • Multi-tenant isolation

API & business logic

  • BOLA / BFLA
  • Mass assignment
  • Excessive data exposure
  • Rate-limiting & brute force
  • Business-logic abuse
  • File upload & path traversal
  • Chained exploit paths
97 OWASP WSTG v4.2 test casesOWASP Top 10 + API Security Top 10Web apps + APIs
Why Barrion

Findings you can check yourself.

Checked against your live app

Findings are replayed against your live app before they're reported. One that doesn't reproduce is dropped, and one we can't replay is kept as a lower-confidence lead. Confirmed findings come with the request and response.

The tools pentesters use

Every run executes in an isolated, per-engagement Kali sandbox with the same tools a pentester would run: sqlmap, nuclei, ZAP, katana, ffuf, dalfox, jwt_tool and more.

Mapped to OWASP WSTG

Every finding links to a specific OWASP Web Security Testing Guide case. You see exactly what was tested, what was found, and what each result was, with evidence attached.

You set the boundaries

Targets, surfaces, off-limits paths, and credentials are approved by you before any traffic is sent. Probes are rate-limited and non-destructive by design.

Report within a working day

A run finishes within hours. From Standard level up, a security engineer reviews the findings and the report is released within one working day. A Light report is released as soon as the run completes. You can watch the test progress in your dashboard while it runs.

Fix it, then prove it's fixed

Reports ship with remediation your team can apply directly. After you patch, retesting the issues we found is free: the retest reuses your scope and credentials and holds no credits.
How it compares

Between a scanner and a six‑week engagement.

FeatureAutomated scannerBarrion AI pentestTraditional pentest
Confirms exploitabilityFlags patternsConfirmed with request and responseYes
Coverage mapped to WSTGPartialAll 97 casesVaries by firm
TurnaroundMinutesHours, report within a day2 to 6 weeks
False-positive controlLowChecked against the live appManual review
Remediation + retestGeneric advicePer finding, retest includedUsually extra
Reruns as you shipOn a scheduleFrom CI/CD or on a schedule, daily and upBooked again each time
Scope your pentest

Find out what is actually exploitable.

Tell us about your target and we will reply within one working day with scope, pricing, and a timeline. Prefer email? pentest@barrion.io.

  • A 30-minute call, no obligation.
  • You decide what is in and out of scope.
  • No charge until the scope is agreed.
  • A retest after you patch is included.

Rather not wait for a call? Start a self-serve pentest from your dashboard, paid in credits, no call needed.

“We used to get one pentest a year, and the report was out of date a few releases later. We built Barrion so every release gets tested the way an attacker would, not just the one in the audit window.”

Mikael Karlgren, Founder of Barrion
Mikael Karlgren, Founder of Barrion
LinkedIn

Tell us about your target

Takes about 60 seconds. No credit card, no commitment.

FAQ

AI pentesting, answered.

Will an AI pentest break my application or data?
Every probe is rate-limited and non-destructive by design. The agent usually confirms exploitability from the response, for example a blind SQL injection that produces observable timing differences, or a request that returns 200 where it should return 403. Tests send real requests and can create test data, so point them at staging if that matters. You also approve the scope and any off-limits paths before a single request is sent, and many teams run the first engagement against staging.
How is this different from an automated scanner?
A scanner pattern-matches and hands you a list of maybes. Barrion's AI actively tests the target the way a real attacker would. It chains requests, reasons about your specific app, and then replays each finding it can against the live target before reporting it. Findings that don't reproduce are dropped. Confirmed findings come with the exact request, response and remediation, and anything we couldn't confirm is clearly marked and capped in severity.
Can AI pentesting replace a human pentester?
Not entirely. It covers the part most teams need most often: the OWASP Top 10, the API Security Top 10 and all 97 WSTG cases, with findings checked against the live app before they're reported. From Standard level up, a security engineer reviews the findings, and from Deep up that engineer signs off the report. You can offer it as your yearly test to an auditor or an enterprise customer. Whether it counts is their call. Business-logic judgement and bespoke manual work still belong to people, so many teams run Barrion as their ongoing pentest and keep a periodic manual engagement.
What do I actually receive at the end?
A ranked report of findings, each with severity, the affected surface, the mapped OWASP WSTG and CWE references, and remediation steps. Confirmed findings carry the request and response that prove them, and anything we couldn't confirm is clearly marked and capped in severity. From Standard up a security engineer reviews the report, and from Deep up that engineer signs it off. It is delivered as PDF, XLSX and JSON so the same engagement works for internal triage and external review, alongside a full WSTG coverage matrix showing what was tested and the status of each case.
Will my auditor or enterprise customers accept the pentest report?
The report maps every finding to OWASP WSTG, a security engineer reviews it from Standard up and signs it off from Deep up, and a free retest shows what you fixed. Teams use it as evidence for SOC 2, ISO 27001 and NIS2 work. Whether it's accepted is up to your auditor.
How does scoping and pricing work?
Self-serve: pick a level in your dashboard, from Light to Maximum, and the run holds its level's credits when it starts and is charged for what it used. Credits come with a monthly plan or as a one-off top-up, the full report is included, and the credits come back if it is not useful. Prefer a scoped engagement instead? That starts with a 30-minute call, no obligation, and no charge until the scope is agreed. A retest after you patch is included either way.
Is a retest after I fix something included?
Yes, retesting the issues we found is free. Once you've shipped a fix, rerun the pentest as a retest. It reuses the original scope, and the test credentials while they're still stored, checks each finding again and marks it fixed, not fixed or inconclusive. A retest holds no credits.
Can I test staging instead of production?
Yes, and it is often the safer choice for a first engagement. The agent can target any environment you control and authorize, including staging, preview, and pre-launch surfaces. You decide the target during setup.
What if the report is not useful?
A run spends the credits its level reserves, and the full report comes with it: there is no second payment to read the findings. A test that fails is not charged at all, and one you cancel is charged only for the work it got through before you stopped it. If the report still is not useful, email contact@barrion.io and we return the credits it spent.

See what an attacker would find.

Book a call to scope continuous testing across your apps, or start a single pentest yourself before a launch.

Book a scoping callStart an AI pentest