We point AI models built for security testing at your systems, inside the scope you sign. Our testers steer every run and verify every finding before it reaches your report.
Booking now · next testing window starts Mon, Nov 9
HackMoat agentexample
› Goal: from the internet to domain admin. Scope: acme.example, signed 2026-11-02.
09:14❯ Reconmapped 212 hosts; vpn.client.example:443 matches a known vulnerable version
10:02❯ ExploitCVE-2024-3400 confirmed; foothold on the VPN gateway
11:47❯ Pivotreached 10.20.0.0/16
12:26❯ Escalatepath to ad01.corp.local found
✓ Tester verified · stopped at proof, nothing changed
Domain admin3 h 12 min▍
Built onOWASPPTESCVSS 3.1MITRE ATT&CKNIS2ISO 27001
What is HackMoat?
Attackers now use AI models with the safety limits removed. These models find weaknesses faster and keep going all night. HackMoat runs the same kind of model against your company first, under a written authorization, inside the targets and testing window you set. Experienced testers decide what the AI may try, follow every step live, and confirm each finding by hand. You get a report your auditor accepts, so you can fix the problems before someone else finds them.
Watch the 57-second film (English, with captions)
Why AI-driven
Classic pentest
Attacker with AI
HackMoat
Speed
Classic pentestDays of manual work per target
Attacker with AIHours, around the clock
HackMoatHours, around the clock
Coverage
Classic pentestWhat fits in the budgeted days
Attacker with AIEverything it can reach
HackMoatEverything inside your signed scope
Control
Classic pentestTesters
Attacker with AINobody
HackMoatYour scope, your window, our testers
Outcome
Classic pentestA report
Attacker with AIA breach
HackMoatA verified report and a retest
Attackers already run these models against companies like yours. Every week without a test is a week they get to look first.
Pick the depth you need
Each package is a defined scope at a fixed price. Larger packages include everything in the smaller ones.
01
Scout
One AI-driven attack run on your external perimeter, verified by a tester. Your public attack surface, tested from the outside.
AI-driven attacks on your perimeter and web apps, with a tester steering every run. Outside and inside: web application, internal network and workspace.
Pick a package and pay online through Stripe. The price is fixed and listed upfront, so there is no quote to wait for.
2
Sign the authorization
You sign the testing authorization online. It is the legal permission to test: it fixes the scope, the systems and the testing window.
3
We test
We test only what you authorized, only inside the agreed window. If we find something critical, we tell you the same day.
4
Read the report, then retest
You read the full report in your private client portal. Once you have fixed the findings, we retest them.
What a finding looks like
Every finding states what we did, what it means for your business and how to fix it. This one is an example, with client details removed.
Example. Redacted, not a real clientHM-0417-01
CriticalCVSS 9.8
Domain admin in 3 h 12 min via an unpatched VPN gateway
// Attack path
1vpn.client.example:443
2CVE-2024-3400
3ad01.corp.local
What we found
The internet-facing VPN gateway ran a firmware version with a publicly known vulnerability. From there we reached the internal network and took over the domain controller.
Business impact
An attacker with the same access could read, encrypt or delete data on every Windows system in the company.
Fix
Apply the vendor patch, rotate all credentials stored on the gateway and restrict management access to the admin network. We retest after you confirm.
A report you can act on
01
Management summary
Two pages in plain language for directors: what we tested, the main risks and what to do first.
02
Scored findings
Each finding carries a CVSS score, the common industry scale for severity, and a priority based on your business context.
03
Evidence
Screenshots, requests and timestamps for every finding, so your team can reproduce and verify it.
04
Remediation steps
Concrete fixes per finding, written for the people who will make them.
05
Scope and method
Exactly what was in scope, when we tested and which methods we used. Auditors ask for this.
06
Retest results
After the retest, the report shows which findings are closed and which remain open.
NIS2 and ISO 27001
NIS2 is the EU directive that requires essential and important entities to manage cybersecurity risk and to assess whether their measures work. ISO 27001 is the international standard for an information security management system and asks for regular technical testing.
A penetration test does not make you compliant on its own. It does give you independent evidence that your controls were tested, which findings were raised and when they were closed.
NIS2
Evidence for the assessment of the effectiveness of your risk-management measures (Article 21).
ISO 27001
Input for technical vulnerability management and for testing security during development (Annex A, 8.8 and 8.29).
Fortress
Includes a board-ready summary that maps each finding to the relevant NIS2 and ISO 27001 requirements.
Frequently asked
Is this legal?
Yes, because you authorize it. Before we start, you sign a testing authorization that names the systems, the scope and the testing window. We test nothing outside it. If a system is hosted by a third party, you confirm that you are allowed to have it tested.
Will testing break anything?
We test production systems with care. We avoid denial-of-service techniques and destructive actions, and we agree on a testing window that suits you. If something looks unstable, we stop and call you.
Is it safe to let AI attack our systems?
The AI only touches the targets in your signed authorization, only inside your testing window, and stops at proof: it does not change, delete or take data. A tester follows every run live and can stop it at once, and your emergency contact can stop the test at any time.
Who are the testers?
Experienced penetration testers working to public methods such as OWASP and PTES. The testers on your engagement are named in your testing authorization, and they are bound by confidentiality.
How long does it take?
Testing usually starts within two weeks of the signed authorization. Scout is reported within 10 business days of the start of testing. Siege and Fortress take longer because the scope is larger; we agree the dates with you before we begin.
What do you need from us?
A signed authorization, a contact person who can be reached during testing, and the details of the systems in scope. For Siege and Fortress we ship a small remote appliance that you connect to your internal network.
Does our data go into an AI model?
Findings and evidence stay in your private client portal and are deleted as described in our privacy policy.
Find out before they do
Book a package online, or write to us if you are unsure which scope fits.