External attack surface
Web and API assessment passes against targets you own, under written scope.
Scoped security assessments, credits included.
Create an account, watch the intro, and spend 150 starter credits on assessments you are authorised to run. Automated output stays an unvalidated first pass until a person validates it.
People-led agency services remain on pentforge.com. Part of the Norcode SRL projects. Operated by Cyber Security RO SRL.
What you can run from one account
A clear path from owned target to scoped first pass, with costs visible before you commit and people in control throughout.
Cloud and network checks
Configuration and network passes that land findings for triage - not silent blocking.
Human validation lane
Buy or request practitioner validation so automated first-pass output becomes a reviewed report.
Credits you can see
Signup starts with 150 credits. Every pass shows its cost before you spend.
Trust without invented badges
Scoped by design
Verified ownership and signed rules of engagement before any assessment runs.
Human validation path
Automated output is an unvalidated first pass until a practitioner validates it.
People can stop any run
Operators remain in control. There is no claim of fully autonomous testing.
EU operator
Cyber Security RO SRL, Bucharest. Enquiry and account data handled under our privacy policy.
Hosted testingWatchlineGuardianCompliance GuardCloud CoordinatorISO 27001GDPRNIS2DORA
Norcode SRL projects
Gated testing, then a person
Hosted testing, Guardian, and Compliance Guard are in beta. Watchline and Cloud Coordinator are planned. Every request uses the same four states. Submit records the request. It does not launch a live scan.
01
Awaiting ownership
The token sits on the target you named.
02
Awaiting scope
A signed PDF, with the signer and attestation.
03
Ready
The credit cost is visible before you spend.
04
Queued
Credits debit. A queue reference is kept. No live scan starts.
Ownership comes first
A run cannot start until you prove the named target is yours. Place a random token in DNS TXT at _pentforge-verify.your-domain, or in /.well-known/pentforge-verify.txt. The account that places the token is the customer of record for that request.
One legal path
The request moves from awaiting ownership, to awaiting scope, to ready, to submitted. Nothing skips a step. A signed scope PDF is required. Cancel is available only before submit.
APIs for your own rows
Create an assessment request, verify ownership, upload scope, submit, cancel, and read the credit ledger. Each call returns only your account's rows.
Community work stays free
CIS benchmarks, MITRE ATT&CK, and CWE stay free and credited. We use them as published. The charge is the hosted gate, the ownership check, the signed scope, the ledger, human review, and operator time.
Shorter SMB report
The SMB track is a shorter first pass mapped to those community frameworks. It stays labelled unvalidated until a person reviews it. Compliance Guard prepares evidence. It does not issue a certificate.
Advanced workspace
The advanced track is a person-reviewed report. That engagement can include full use of an isolated attack VM an operator opens for the signed target only. It is not on every account, and it is not a self-serve scan of the internet.
Targets you can name
Four kinds. The credit cost is the one in your account before you submit. Signup starts with 150 credits. An illustrative name such as app.example.com is not a customer.
40 credits
External web
A site you own, checked only after the token matches.
50 credits
API
An interface you own, under the same signed scope.
60 credits
Network
A network range you own. Private and metadata addresses are refused.
35 credits
Cloud config
Configuration you can prove is yours, still inside the signed scope.
Assessment APIs
Session required. Rows from another account are not returned.
- POST/api/assessment-requestsCreate the request and receive the ownership token.
- GET/api/assessment-requestsList only your requests.
- GET/api/assessment-requests/:idDetail, proof instructions, and scope metadata.
- POST/api/assessment-requests/:id/verify-ownershipDNS TXT or well-known file. Private addresses are refused.
- POST/api/assessment-requests/:id/scopeUpload the signed scope PDF.
- POST/api/assessment-requests/:id/submitDebit credits and queue. No live scan.
- POST/api/assessment-requests/:id/cancelStop from any state before submit.
- GET/api/me/ledgerYour credit ledger only.
Today, and what comes later
An account can move a request through ownership, signed scope, and a queued submit. Later items stay labelled as later. None of this starts a live scan from the page.
On this account
Create the account
A new account receives 150 starter credits. The dashboard intro shows the same gated path.
Name an owned target
External web is 40 credits, an API is 50, a network is 60, and cloud config is 35. The cost is shown before you spend.
Prove the target is yours
Place the token in DNS TXT at _pentforge-verify.your-domain, or in the well-known file on that host. Private, loopback, and metadata addresses are refused.
Queue the signed request
After the signed scope PDF is accepted, submit debits the credits and keeps a queue reference on the request. That does not start a live scan.
Planned. Not on every account yet
Watchline
Watchline (formerly ObserveAI) is planned observability for estates you operate. It is not available today, and it is not available on every account yet.
Cloud Coordinator
Cloud Coordinator is planned. It is not available today, and it is not available on every account yet.
Person-reviewed report
A person-reviewed advanced report adds a person's review beyond the automated first pass. It is not available on every account yet.
Operator attack workspace
An operator-opened attack workspace is one isolated attack VM an operator opens for that signed target only. It is not self-serve internet scanning, and it is not available on every account yet.
Flagship testing plus the estate stack
Hosted testing is the security flagship. Watchline, Guardian, Compliance Guard, and Cloud Coordinator extend the same account into observability, hunting, evidence prep, and multicloud correlation as each module lands.
- beta
Hosted testing
Scoped assessments with a clear first-pass label.
Request web, API, network, and cloud-config assessments against targets you own. Automated output is an unvalidated first pass until a person validates findings. Nothing runs without verified ownership and signed scope.
- External web and API assessment passes
- Network and cloud configuration checks
- Findings with reproduction steps when validated
- planned
Watchline
formerly ObserveAI
AI-assisted security observability for estates you operate.
Correlates telemetry and security signals to help operators see what changed. Assists analysts; it does not replace human judgement or claim autonomous response.
- Signal correlation across approved data sources
- Operator-facing summaries for triage
- Hooks into metrics and log pipelines you control
- beta
Guardian
Threat-hunting workflows for cloud estates.
Hunting playbooks rooted in the OCI threat-hunting line, expanded toward multicloud. Designed to interrogate security tools via APIs and MCP adapters under your credentials.
- Hunt playbooks for cloud control planes
- API and MCP adapters to security tools you enable
- Evidence packs for analyst follow-up
- beta
Compliance Guard
Evidence preparation for frameworks you answer to.
Gap analysis and evidence mapping designed for audit readiness themes such as ISO 27001, GDPR, NIS2, and DORA. Preparation support - not a certificate and not legal advice.
- Control mapping to frameworks in scope
- Evidence collection checklists
- Exportable packs for your auditors
- planned
Cloud Coordinator
Per-CSP security agents that correlate attacks across clouds.
One specialist agent per cloud provider (OCI, AWS, Azure, GCP) that interrogates security-related tools via APIs and MCPs, lands data in Log Analytics, metrics, and APM surfaces you operate, and correlates attack narratives for analysts.
- CSP-specific agents (OCI, AWS, Azure, GCP)
- Security tool interrogation via APIs and MCPs
- Correlation into Log Analytics, metrics, and APM
Simple plans. Serious scope rules.
Market-aligned credit packs. No card required for Community signup. Enterprise is scoped with a human.
Community
Free
Create an account, get starter credits, and see how scoped testing works.
- Account + starter credits on signup
- Platform intro video and capability catalogue
- Request a scoped assessment (ownership required)
- Unvalidated first-pass reports labelled clearly
Automation
€249 / mo
Continuous scoped assessment capacity for teams that already own their targets.
- Everything in Community
- 800 credits included each month
- Web, API, network, and cloud-config passes
- Human validation add-on available per finding set
- Priority queue for scoped runs
Enterprise
Custom
People-led oversight, custom credit packs, and multicloud coordinator retainers.
- Named practitioner oversight
- Custom credit packs and SLAs
- Multicloud coordinator modules
- Compliance preparation support (not a certificate)
- Dedicated scoping and re-test windows
What the platform does for operators
Ownership, the four request states, your targets, the assessment APIs, the shorter SMB report, and the operator-opened attack workspace on an advanced engagement.
Start with scope.
Keep people in control.
Create an account, receive starter credits, and prepare your first authorised assessment request.
Create account