Skip to main content
Vulncure
Join
AI security testing for SaaS, launching soon

Test your SaaS security.
Understand what to fix.

AI agents test web apps and APIs you’re authorized to assess. Review validated findings with evidence and fix guidance, then request verification after a fix.

Vulncure product dashboard showing the workspace overview, projects, and security posture.
Current product dashboard · example workspace data

From authorized scope to validated findings.

Recon stage with aligned endpoint railA target URL feeds a single vertical endpoint rail. Four evenly spaced branches connect to the endpoint rows, then merge toward the root agent. A shared flow line exits at the bottom.TARGETapp.example.comGET/loginPOST/api/ordersGET/adminEnumerating…root agentAPPLICATION MODELRoutesAssetsContext

A root agent studies your application first, the way an attacker would.

Agents testing in parallelSeveral agents work across injection, authorization and business-logic testing. The visible rows are examples of a larger, expanding pool of agents, and candidate findings flow toward proof validation.AGENT TESTINGAgents work in parallelInjection agentAuthorization / IDOR agentBusiness logic agentInputs, payloads, sinksIdentity, ownership, accessCheckout, state, workflowsMore agents spawningCRITICALHIGHMEDIUMCandidatefinding

Specialist agents focus on the relevant parts of your application, including access controls and inputs. The scan runs within the scope you authorize, and potential findings are checked before they reach your team.

Verify and report stageCandidate findings converge into a verify agent that reproduces each claim. Confirmed findings flow to an alert over email and in-app notifications; the rest drop.CRITICALHIGHMEDIUMverifying03 / VERIFY & REPORTA second agent checks every finding.IDOR/api/ordersMissing rate limit/loginVerbose errors/searchverify agentREPRODUCES EACH CLAIMInstant alertemail + in-appDropped

Validated findings include evidence and guidance for your next fix. Severity reflects the issue itself, and a scan can finish without a validated finding.

See what remains open.

AI and manual findings appear together, with open issues by severity and fixes that have passed verification.

Security posture29Grade F
8open
Critical2
High2
Medium4
Low0
Info0
80%resolved

32 of 40 findings fixed

Illustrative: one workspace's posture; the grade climbs as retests pass

More room to test with Full.

Full is planned for eight AI scans per month per target, access to Deep mode, and unlimited seats. GitHub-connected fix PRs are planned for a later release.

Scan allowanceA stack of pooled scans with the active run highlighted and the monthly allowance below.

More scans with Full

Full is planned for 8 AI scans each month per target. Pool them across subscribed targets; fix-verification re-scans do not count.

Deep attack-path analysisA target branches into three testing paths that converge on a highlighted verified result.

Deep mode in Full

Deep mode is available on Deep and planned for Full. It tests deeper attack paths and business-logic issues.

Unlimited team seatsFour individual user nodes connect to a shared workspace at the center.

Unlimited seats planned

Full is planned to include unlimited workspace seats for your team.

Autofix pull request diffIllustrative preview of planned autofix: replace an authentication bypass with a check that returns HTTP 401 for an unauthenticated request.fix/auth-bypass+1−1121314−if (!user) return next();+if (!user) return res.sendStatus(401);

Autofix (coming soon)

GitHub-connected fix PRs are planned for Full. This feature is not available yet.

Availability

Full is in early access

Planned price

$299/mo or $2,870/yr, USD

Findings

Validated evidence + fix guidance

After a fix

Request verification

A result your team can act on.

The report helps your team understand what was tested, what was validated, and what to do next. A scan can also finish without a validated finding.

01

Review the evidence

See the affected part of your application, severity, and evidence for a validated finding.

02

Make the fix

Use the remediation guidance to address the issue in your own code and workflow.

03

Verify the result

Request a re-scan of a fixed finding and review whether the change passed verification.

Your questions, answered

What does Vulncure test?

Vulncure is designed to test authorized web applications and APIs. The agents explore the available application, test potential vulnerabilities, and validate findings before reporting them. Results depend on the scope and access you provide.

What will I receive from a scan?

The scan record includes its progress and reported findings. Validated findings include evidence, a severity assessment, and remediation guidance. Your team can review the result, make a fix, and request verification.

How often do the agents run?

Planned tiers include Lite with 2 scans per month per target, Deep with 4, and Full with 8 while Full remains in early access. We will confirm pricing and available access in the launch email. Re-scans of fixed findings do not use the monthly allowance.

What if a scan finds nothing?

A scan with no validated findings is still a useful record of the testing performed. It does not establish that the application is secure; review the scope and access used alongside the result.

Can I start with the AI finder and add a manual pentest later?

Yes. Manual web application pentesting is a separate Vulncure service. If a customer or auditor asks for a particular assessment or document, confirm that requirement before choosing a service.

Why do I need a work email?

The current signup and launch-list forms accept work addresses and reject common public or disposable email providers. Testing also requires authorization for the target application.

What does the flat fee include?

The manual web application pentest is a separate flat-fee engagement with scoping, a kickoff call, testing, a technical report, and a remediation retest.

What does joining the list get me?

One email when the AI platform opens, with availability, pricing, and how to get started. Joining is free and does not create an account or start a scan.

What do I need before testing?

An application you are authorized to test and a defined scope. The setup flow will explain verification and any supported access configuration before a scan begins.

Does joining the list give me early access?

No. The list is for the launch announcement. We will explain available access in that email.

Vulncure launches soon. Get the announcement.

One email when access opens: what's available, what it costs, and how to start. Joining is free and does not create an account.

AI platform launch list · No charge to join

01Join02We launch03You hunt