Barrion facts

Barrion runs continuous, agentic AI penetration tests of web applications and APIs. AI agents test your app the way an attacker would, safely, on a schedule, from your CI/CD pipeline through the Barrion API, or on demand. Findings are checked against the live app before they're reported, and tracked across runs as new, still open, resolved or regressed. From Standard level up, a security engineer reviews each report. Barrion AB is based in Gothenburg, Sweden.

Every number Barrion publishes about itself is on this page, and the prices and credits come straight from our billing configuration. If you're citing Barrion, use these values.

We sell two things.

1. AI pentesting. Specialist agents test your web app or API from an isolated sandbox the way an attacker would, chain requests across endpoints, and check their findings against the live app before they go in the report. Run it on a schedule or on demand. How AI pentesting works
2. Passive scanning. A read-only scan of your live app, on a schedule, that flags misconfigurations and drift between pentests. It's safe to point at production. Passive scanning

You can save a pentest and rerun it on a schedule, so the report keeps up with your app instead of describing last year's version of it.

• ✓Schedules: daily, weekly, monthly, quarterly, every six months, yearly, or a custom rhythm.
• ✓One target can have several schedules. A daily Light run plus a monthly Deep run, for example.
• ✓Each schedule has its own scope and depth. Choose whether it runs every time, or only when your app has changed. For on-change runs we compare a snapshot of your start page's links and scripts at each scheduled check. If it changed, the saved pentest reruns in full at the level you picked. If there's no earlier baseline, a full run happens first.
• ✓Each run's findings are compared with the run before and labelled new, still open, resolved or regressed. You can mark a finding as ignored.
• ✓A retest reuses the original scope, and the test credentials while they're still stored, and holds no credits.
• ✓Scheduled pentests are part of the Business plan.

Trigger a pentest from any CI/CD pipeline by calling the Barrion REST API.

Continuous programs are scoped to your apps, cadence and depth. Talk to us and we'll price it for your setup. More on the model: continuous pentesting.

• ✓Ranked findings, each with severity, the affected surface, OWASP WSTG and CWE references, and steps to fix it. Confirmed findings carry the request and response that prove them. Anything we couldn't confirm is clearly marked and capped in severity.
• ✓Delivery as PDF, XLSX and JSON, plus a WSTG coverage matrix with the status of each of the 97 cases.
• ✓A retest after you fix, reusing the original scope and stored credentials, at no extra charge.
• ✓Expert review from Standard level up, with the hours in the table above.

See one first: sample pentest report (PDF).

We test web applications and APIs. We don't test internal networks, Active Directory, threat-led penetration testing (TLPT) under DORA, mobile apps, physical security or social engineering.

1. You approve targets, credentials, surfaces and off-limits paths. Nothing is sent before that.
2. A root agent maps hosts, endpoints, parameters and auth flows.
3. It hands each attack area to a specialist agent. They work in parallel with real tools (sqlmap, nuclei, ZAP, katana, ffuf, dalfox, jwt_tool and others) inside a Kali sandbox built for your engagement alone.
4. Every finding is checked against your live app before it's reported. Confirmed findings come with the request and response that prove them. Anything we couldn't confirm is clearly marked and capped in severity. The checks are a replay check, a proof-of-concept agent that re-runs the exploit on selected findings and marks each one confirmed, refuted or inconclusive, and an AI review.
5. From Standard level up, a security engineer reviews the report and it's released within one working day.
6. You fix, then run the retest.

The run itself finishes within hours.

Probes are rate-limited and non-destructive. Scope is approved before any traffic goes out, and you can point a test at staging, a preview or a pre-launch environment instead.

Passive scans look at what your live app already exposes: TLS, HTTP security headers, cookie attributes, CORS, DNS, email authentication, exposed services and known CVEs in shipped JavaScript libraries. They're read-only.

Free runs 18 checks. Paid plans run 35+. Essential scans 1 domain and its subdomains weekly, and Business scans 10 domains daily.

Proof-backed pentesting

A penetration test in which every reported finding has been reproduced before it is reported, with the request, the response and the observed impact attached, and anything unproven dropped or labelled unverified. Defined by Barrion, 2026-09-26.

Time to Proof (TTP)

TTP = t(first reproduced critical or high finding) − t(scope authorised). Measures how fast a test produces a proven, actionable finding, not how long the engagement lasts. Defined by Barrion, 2026-09-26.

TTP-change

The continuous-testing variant of Time to Proof: TTP-change = t(first reproduced critical or high finding) − t(change deployed or detected). It only exists for teams that test continuously.