Frequently Asked Questions

An autonomous AI penetration test is a full penetration test in which AI agents perform reconnaissance, planning, exploitation and validation without a human operator driving each step, while certified security experts review and sign off the final report. SignalRed's autonomous pentest runs on our Breachloom platform and delivers an expert-validated, compliance-ready report in 1 business day.

Breachloom is SignalRed's autonomous AI penetration testing platform. It validates the authorized scope and credentials, maps the application, builds a risk-prioritized test plan from OWASP WSTG, OWASP Top 10 and OWASP API Top 10, runs hundreds of specialised agents in parallel, records every request through a scope-enforcing evidence proxy, reconciles coverage against captured evidence rather than agent claims, independently reproduces findings, and generates a draft report that a human expert reviews and signs.

The Standard plan covers external infrastructure and unauthenticated web application testing with OWASP Top 10 coverage. The Advanced plan adds authenticated web application testing with multiple user roles, REST and GraphQL API security testing, business-logic testing and extended infrastructure coverage. Enterprise scopes can include custom targets, continuous testing and dedicated experts.

A scanner matches signatures and reports suspected issues, many of them false positives. Breachloom behaves like a penetration tester: it understands the application's features and roles, chains weaknesses into real attack paths, proves exploitability with a working proof-of-concept, and tracks what was and was not tested in an evidence-backed coverage matrix. Only confirmed, reproduced vulnerabilities reach the report.

Yes. Every finding is first reproduced by an independent validation agent and then reviewed by a certified SignalRed penetration tester who verifies exploitability, assesses business impact and signs off the final report. Automated drafts and approved reports are clearly distinguished.

Testing can start within 24 hours of scoping and authorization, and the expert-validated PDF report is delivered in 1 business day. Our team responds to requests within 2 hours during business hours.

Pricing starts at $3,000, which is the minimum for a simple website (Standard plan). The Advanced plan starts at $5,000 and the Enterprise plan is quoted individually. There are no hidden fees; the price is agreed up front based on scope.

Yes. Reports include an executive summary, scope and methodology, coverage and limitations, detailed findings with proof-of-concept evidence, risk ratings, remediation guidance and expert sign-off, and are structured for SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, NIST CSF 2.0 and other frameworks.

Yes, with controls. Testing is limited to approved targets only, traffic passes through a scope-enforcing proxy with rate and concurrency limits, destructive techniques are disabled unless you explicitly allow them, you can define constraints and known non-issues, and any accounts, files or records created during testing are cleaned up or reported.

Only the target URLs or IP ranges and written authorization to test them. Optionally you can provide test accounts for each user role, API specifications, source code and documentation, and any testing constraints — the more context you share, the deeper the coverage.

SignalRed's application security testing covers web applications, mobile applications (iOS and Android), REST and GraphQL APIs and the source code behind them. We test every endpoint, API method and route for injection, authentication and authorization flaws, business-logic abuse, cryptographic weaknesses, client-side issues and financial-logic errors.

Assessments follow the OWASP Web Security Testing Guide, OWASP API Security Top 10, OWASP ASVS and OWASP MASTG, combined with SAST and DAST tooling whose output is manually verified to eliminate false positives.

Yes. Business and financial logic is a core focus: double spending, rounding errors, transaction amount tampering, race conditions, mass assignment, IDOR and privilege escalation. Many of our customers are fintech companies, banks and payment gateways that need this depth for PCI DSS and regulatory requirements.

You receive a PDF report with an executive summary, a description of the inventory and data flows, every finding with risk level, exploitation steps and remediation advice, plus access to our PTaaS dashboard. One free re-test confirms that fixes are effective and the final report reflects remediation status.

The Autonomous AI Pentest (from $3,000) is run by AI agents with expert validation and is ideal for fast, compliance-driven coverage. The application security assessment is a manual, AI-augmented engagement led by senior testers and is recommended for complex applications, fintech logic and source-code review.

External Attack Surface Management is the continuous discovery, inventory, monitoring and testing of every internet-facing asset an organisation owns — domains, subdomains, IP addresses, cloud services, web applications and APIs — to find exposures before attackers do.

In addition to classic asset discovery and vulnerability scanning, SignalRed EASM launches AI pentest agents from our Breachloom platform against newly discovered or changed perimeter assets. Findings are confirmed with proof-of-concept evidence and triaged by our analysts, so you get verified vulnerabilities, not scanner noise.

Domains and subdomains, A/AAAA records and IP ranges, open ports and network services, web services on non-standard ports, technologies and versions, certificates, exposed credentials and misconfigurations. Dashboards show key metrics, vulnerabilities by severity and status, exposure trends over time and assets pending approval.

A vulnerability scanner checks a list of assets you already know. EASM first discovers assets you may not know about (shadow IT, forgotten subdomains, staging environments), continuously tracks changes, and in SignalRed's case adds AI pentesting and human triage on top of scanning.

SignalRed EASM is a subscription priced by the size of your external attack surface, with optional supervision by our analysts who develop custom vulnerability templates and triage findings.

A Secure Software Development Life Cycle embeds security activities — threat modelling, secure coding standards, SAST, DAST, SCA, secrets scanning and security testing — into every phase of software development, so vulnerabilities are prevented or caught before release.

Application Security Orchestration and Correlation (ASOC) aggregates the output of security scanners (SAST, DAST, SCA, IaC and container scanning), deduplicates and correlates findings, pushes them to defect trackers and produces actionable dashboards that prioritize remediation and improve time-to-fix.

We integrate scanners into your CI/CD pipelines through our ASOC platform API, add custom testing scenarios for your stack, connect results to Jira or similar trackers, define security gates and train your developers. Ongoing advisory and security assessment as a service keep the process effective.

Both open-source and commercial SAST, DAST, SCA, secrets and container scanners, chosen to match your languages and infrastructure. The ASOC platform is tool-agnostic and correlates results from any source.

SignalRed LLC is incorporated in the United States (8 The Green, Ste A, Dover, DE 19901) and headquartered in Dubai, United Arab Emirates. We serve customers across the USA, Europe, the Middle East and Asia-Pacific.

More than 30 security professionals: penetration testers, application security engineers, reverse engineers, cryptographers, hacking competition champions and HackerOne Top-100 bug bounty hunters.

SignalRed is a CREST Pathway organisation. Team members hold OSCP, OSEP, OSWE, OSWP, BSCP, CRTP, CompTIA PenTest+, CEH Practical, KLCP and eJPT. The team placed Top-15 three times and Top-5 once in the HackTheBox Business CTF (2022–2024).

SignalRed was founded in 2021 by Omar Ganiev, a penetration tester and security researcher who serves as CEO. You can book a meeting with Omar directly from the website.

Email info@signalred.io, fill in the contact form on any page, or book a call with the CEO. We respond within 2 hours during business hours and a quote is usually ready the same day.