For agencies
Pentest every client app before you hand it over.
Clients get asked for a pentest report, and a header scan won't pass. Barrion's AI agents test each client's web app and API on a schedule, whenever the site changes, or on demand, and confirmed findings come with the request and response behind them. Retests of found issues are free. For a pitch, run a free passive scan of the prospect's site in the call, then sell the ongoing testing.
Continuous AI pentesting
Ongoing testing for every client on the roster.
Each client app gets its own schedule, and a run can wait until the site has changed.
How it runs
As often as you ship
Save a pentest and it reruns daily, weekly, monthly or on your own rhythm, or only when your app has changed. You can also start one on demand from the dashboard.
What's tested
Your web app and API
Specialist agents work in parallel on injection, access control, authentication and business logic, mapped to the OWASP WSTG test cases, the OWASP Top 10 and the OWASP API Security Top 10.
Checked
Findings checked against the live app
Confirmed findings come with the request and response behind them. Anything unconfirmed is clearly marked, so you know which is which.
Run over run
New, open, resolved or regressed
Each run is compared with the last one, so you see what's new, what's still open, what you fixed and what came back.
Retests
Free retests of found issues
Fixed something? Retest it at no charge. The retest reuses the scope and test accounts from the original run.
Engineer review
A security engineer looks first
From Standard up a security engineer reviews the findings, and deeper tests come with a report signed off by that engineer.
Tests are rate-limited and non-destructive, and you approve the scope before any traffic goes out. Continuous programs are scoped to your apps, cadence and depth, so talk to us and we'll price it for your setup.
What agencies use it for
From new-business pitch to quarterly retainer.
Multi-site
Every client app in one dashboard
Each client gets its own saved pentests, schedules and reports, all from one account.
Reports
Reports clients can use
Pentest reports in PDF, XLSX and JSON with an OWASP WSTG coverage matrix, reviewed by a security engineer from Standard up. Clients can hand them to their auditor.
Retainer
Recurring revenue from testing
Put scheduled pentests on each retainer, with passive monitoring and alerts to your Slack in between. Each run shows what's new, fixed or regressed.
Handover
Tested before you hand it over
Pentest a client app before launch, fix what's found, retest for free and hand over the report with the site.
Stack-aware
Findings written for the dev team
Whether the client built on WordPress, Webflow, Next.js or a custom stack, fix steps are framework-specific, so handoff to dev is clean.
Pricing
Volume that fits an agency
Priced to what you run: how many client apps, how often and how deep. No per-client surcharge.
What you can give clients
Evidence, not promises.
- ✓Pentest reports with severity-ranked findings, and the request and response behind each confirmed one
- ✓Run-over-run results: new, still open, resolved or regressed
- ✓Free retests after the client's team ships a fix
- ✓Passive scan PDF and CSV exports mapped to SOC 2, ISO 27001, PCI DSS and NIS2
- ✓Alerts by email, Slack or Teams when passive monitoring spots a regression
Free passive tools
For the pitch: a free passive check.
Free passive tool
Complete Security Scan
Run a passive scan of a prospect's URL and walk them through what it shows in the call.
Free passive tool
Security Audit Tool
Generate a passive audit of a site's configuration that you can attach to a client proposal.
Free passive tool
Security Compliance Checker
Map passive findings to PCI DSS, HIPAA, SOC 2, ISO 27001, and GDPR for the client's auditor.
Related guides
More for your team.
For startups
Security for startups
Pentests before your first enterprise security review, with passive monitoring in between.
For developers
Security for developers
Pentests that rerun on a schedule, with fixes written for your stack.
Lean teams
Teams without a security engineer
AI pentests with engineer review from Standard up, for teams without an AppSec hire.
FAQ
Pentesting for agencies, answered.
Can I white-label Barrion reports for my clients?
A Barrion pentest report includes the client's domain, the test date, the findings with fix steps and an OWASP WSTG coverage matrix, and from Standard up it has been reviewed by a security engineer. Agencies can attach the report to their own client deliverable or include it as an appendix to a security review.
How many client domains can I cover on one plan?
Essential covers passive monitoring of 1 primary domain plus its subdomains. Agencies use the Business plan, which includes scheduled pentests and covers 10 domains, each with its own saved pentests, schedules, reports and alerts. Larger rosters are handled through sales, and the plan allows up to 500 manual passive scans a day.
What's the workflow when a critical finding hits at 2am?
Passive-monitoring alerts go to your email, Slack or Teams, and scheduled pentests email new and regressed findings. Your team triages, opens a ticket against the client and attaches the fix steps from the dashboard. Once the fix ships, retest it for free.
Can I use Barrion in a new-business pitch?
Yes. Run a free passive scan of the prospect's site during the discovery call and walk through what it shows. Then quote for a pentest of their app, the fixes and ongoing testing. The pitch isn't 'we're a security agency', it's 'here's what your site looks like right now, and here's how we'll keep it tested.'
How does Barrion's pricing work for agencies with growing client rosters?
Continuous programs are scoped to your apps, cadence and depth, so talk to us and we'll price it for your setup. We don't charge per finding, per user or per seat. What moves the price is the number of client apps, how often they're tested and at what depth.
Test a client app now.
Start an AI pentest from the dashboard, paid in credits. For ongoing testing across your client roster, talk to us.