Penti

What Penti is

Penti provides agentic AI penetration testing through API, self-hosted, and web platforms, with hybrid deployment listed. Its agents enumerate reachable assets and test five layers: the external perimeter, applications, internal networks, identity, and data stores. Testing covers web applications, APIs, networks, and mobile, with finding management and evidence capture. Findings include replayable exploit chains and mappings to SOC 2, ISO 27001, HIPAA control testing, and MITRE ATT&CK. Certified pentester validation is available on every plan, while full scoped manual engagements are sold separately as Expert Pentest Credits. Penti says retests are unlimited and do not consume credits. Customers set targets and test windows, prove ownership, configure rate limits, review audit logs, and can stop runs with a kill switch. Free external attack-surface mapping is available up to three times monthly without a card. Paid plans start at $20/mo with a 14-day trial. Penti is identified as a Certypie Inc product.

Who it suits

Penti fits startups, lean teams, organizations pursuing SOC 2, ISO, or HIPAA, and security-mature organizations. Its controls and deployment options also suit teams needing managed testing boundaries.

Limits

Free access is limited to external attack-surface mapping three times per month. Starter provides 20 credits monthly; higher plans increase credits and may add on-premises, hybrid or air-gapped testing, human-verified findings and support levels.

Getting started

1. Open the Penti website
2. Use free external attack-surface mapping up to three times monthly without a card
3. Start the 14-day trial for a paid plan
4. Choose API, self-hosted or web access
5. Select a plan such as Starter, Launch, Plus or Advanced
6. Define targets, testing windows and ownership before running tests

Verdict

Penti combines automated agent testing with optional human validation and detailed evidence. Buyers should account for separate manual engagements and plan-specific integrations.