Skip to main content
Vulncure
Join
AI security testing for SaaS, launching soon

Test your SaaS security.
Understand what to fix.

AI agents test web apps and APIs you’re authorized to assess. Review validated findings with evidence and fix guidance, then request verification after a fix.

Free to join. Work email required. One launch email.

Vulncure product dashboard showing the workspace overview, projects, and security posture.
Current product dashboard. Example workspace data.

From authorized scope to validated findings.

Map the authorized applicationIllustrative target app.example.com. In-scope routes, inputs, and authentication context feed the root agent. Its application map exits downward toward specialist testing. Mapping a route does not validate its security.Authorized targetIllustrativeapp.example.comIn-scope routesGET/searchGET/api/orders/:idGET/fetchDiscovering routes…Root agentApplication mapRoutesInputsAuth context

A root agent studies your application first, the way an attacker would.

Specialists test the mapped routes in parallelIllustrative specialists test concurrently. The spotlight cycles through injection, access control, and SSRF. Each incoming packet reaches its matching specialist before a named discovery continues to proof. Orange, red, and blue identify routes, not severity.Specialists test in parallelIllustrativeDifferent tests. Shared authorized scope.Injection agent/searchAccess control agent/api/orders/:idSSRF agent/fetchInjectionCandidateNeeds proofMore specialists join as needed

Specialist agents focus on the relevant parts of your application, including access controls and inputs. The scan runs within the scope you authorize, and potential findings are checked before they reach your team.

A separate agent validates each candidateIllustrative candidate findings enter a separate validation agent. Reproduced findings are reported with severity, evidence, and guidance; candidates that do not reproduce are not reported. High, Critical, and Medium are example severities, not fixed ratings for these vulnerability types. This validates a finding, not a customer fix.Candidates need proofIllustrativeA separate agent reproduces each claim.Injection/searchObject access/api/orders/:idSSRF/fetchValidation agentReproduce + reviewValidatedInjectionHighNot reproducedValidated findings include evidence and guidance.

Validated findings include evidence and guidance for your next fix. Severity reflects the issue itself, and a scan can finish without a validated finding.

See what remains open.

Security postureSecurity health score 29Grade F

Open findings

Critical
2
High
2
Medium
4
Low
0
Info
0

Remediation progress

80%marked fixed

32 of 40 findings

Marked fixed and verified are tracked separately.

Illustrative workspace data · 40 findings, with 8 still open

Findings from AI scans and manual pentests in one workspace.

See what's still open and which fixes have passed verification.

Verification is recorded per finding after a passing retest.

More room to test with Full.

Full is planned for eight AI scans per month per target, access to Deep mode, and unlimited seats. GitHub-connected fix PRs are planned for a later release.

Scan allowanceA stack of pooled scans with the active run highlighted and the monthly allowance below.

More scans with Full

Full is planned for 8 AI scans each month per target. Pool them across subscribed targets; fix-verification re-scans do not count.

Deep attack-path analysisA target branches into three testing paths that converge on a highlighted verified result.

Deep mode in Full

Deep mode is available on Deep and planned for Full. It tests deeper attack paths and business-logic issues.

Unlimited team seatsFour individual user nodes connect to a shared workspace at the center.

Unlimited seats planned

Full is planned to include unlimited workspace seats for your team.

Autofix pull request diffIllustrative preview of planned autofix: replace an authentication bypass with a check that returns HTTP 401 for an unauthenticated request.fix/auth-bypass+1−1121314−if (!user) return next();+if (!user) return res.sendStatus(401);

Autofix (coming soon)

GitHub-connected fix PRs are planned for Full. This feature is not available yet.

Availability

Full is in early access

Planned price

$299/mo or $2,870/yr, USD

Findings

Validated evidence + fix guidance

After a fix

Request verification

A result your team can act on.

The report helps your team understand what was tested, what was validated, and what to do next. A scan can also finish without a validated finding.

01

Review the evidence

See the affected part of your application, severity, and evidence for a validated finding.

02

Make the fix

Use the remediation guidance to address the issue in your own code and workflow.

03

Verify the result

Request a re-scan of a fixed finding and review whether the change passed verification.

Your questions, answered.

What does Vulncure test?

Vulncure is designed to test authorized web applications and APIs. The agents explore the available application, test potential vulnerabilities, and validate findings before reporting them. Results depend on the scope and access you provide.

What will I receive from a scan?

The scan record includes its progress and reported findings. Validated findings include evidence, a severity assessment, and remediation guidance. Your team can review the result, make a fix, and request verification.

How often do the agents run?

Planned tiers include Lite with 2 scans per month per target, Deep with 4, and Full with 8 while Full remains in early access. We will confirm pricing and available access in the launch email. Re-scans of fixed findings do not use the monthly allowance.

What if a scan finds nothing?

A scan with no validated findings is still a useful record of the testing performed. It does not establish that the application is secure; review the scope and access used alongside the result.

Can I start with the AI finder and add a manual pentest later?

Yes. Manual web application pentesting is a separate Vulncure service. If a customer or auditor asks for a particular assessment or document, confirm that requirement before choosing a service.

Why do I need a work email?

The current signup and launch-list forms accept work addresses and reject common public or disposable email providers. Testing also requires authorization for the target application.

What does the flat fee include?

The manual web application pentest is a separate flat-fee engagement with scoping, a kickoff call, testing, a technical report, and a remediation retest.

What does joining the list get me?

One email when the AI platform opens, with availability, pricing, and how to get started. Joining is free and does not create an account or start a scan.

What do I need before testing?

An application you are authorized to test and a defined scope. The setup flow will explain verification and any supported access configuration before a scan begins.

Does joining the list give me early access?

No. The list is for the launch announcement. We will explain available access in that email.

Vulncure launches soon. Get the announcement.

One email when access opens: what's available, what it costs, and how to start. Joining is free and does not create an account.

Free to join. Work email required. One launch email.