ZerodayIQ
Scan my domain free Book a demo
Skip the story ↓

Every website has a second face.

AI penetration testing that never passes a guess off as proof.

ZerodayIQ maps your web app and APIs the way an attacker does, re-fires serious findings against a control request, and hands you replayable proof, exact fixes and a compliance-mapped report. First results in about 10 minutes.

Scan my domain free See a sample report Book a demo

Only domains you verify · Non-destructive by default · From $2,500 per full test

Skip the story ↓
IQ

02 Your site → attacker’s view

1,284 requests · 9 hosts

This is ledgerly.io as its customers see it. Underneath: every page, form, API endpoint and script, mapped by 45 scanner modules and 16 AI agents.

Illustrative example · ledgerly.io is fictional

03 Noise

317 possible issues — most tools stop here.

Version guesses, pattern matches, maybes. Most scanners hand you all of them.

04 The proof

200 ≠ 401 attack and control, side by side

We re-fire serious findings against a control request. When the answers differ, it is proven, and the replay is attached. When no safe re-fire exists, the finding stays a labelled candidate, never “proven”.

Prove it on your site →

Attack · tenant A’s session

200 another tenant’s invoice

differs from

Control · no session

401 Unauthorized

05 Proven

4 proven, each with its own proof

313 maybes dropped. Every finding we report carries its evidence.

Cross-lab review · both labs agree (illustrative)

06 One path

1 path to every tenant’s payroll

02 leaked staging key → 03 staging admin → 01 any tenant’s invoice. Each link verified, not guessed.

07 Report + coverage ledger

1 report exact fixes · mapped to 7 frameworks

38 of 41 vulnerability classes tested · 3 inconclusive · tamper-evident ledger.

See the full sample report →

Pentest report · ledgerly.io

4 proven · 313 dropped · illustrative example

  1. 01Other tenants’ invoices readable by IDtenant B’s invoice 200 · no session 401
  2. 02Live staging key shipped in the JS bundlevalid key 200 · random key 401
  3. 03Staging admin accepts the leaked keyleaked key 200 · no key 401
  4. 04No lockout on sign-in500 attempts · no 429

Fix · 01

- inv = Invoice.get(id)
+ inv = Invoice.get(id, tenant=session.tenant)

Coverage ledger · 38 of 41 vulnerability classes tested · 3 inconclusive · tamper-evident

Mapped to SOC 2 · ISO 27001 · PCI DSS · HIPAA · GDPR · NIST · OWASP

Retest · replay of proof 01 → 404 ✓ closed

08 Coverage

3 ways in one engagement

  1. External

    Black-box web and API testing, the way an attacker first meets you.

  2. Internal

    An agent inside your network maps what an insider could reach.

  3. Autonomous Early access

    An AI that safely attempts real exploits, and stops at proof.

Scan my domain free

How it works

Three steps to your first proof.

  1. 01

    Verify your domain

    Add a DNS TXT record or a well-known file. That’s all an external scan needs. Authenticated and internal scans need credentials or the agent.

  2. 02

    Run

    A quick scan takes about 10 minutes. Full tests take longer and go deeper: 45 scanner modules and 16 AI agents.

  3. 03

    Read proof, fix, retest

    Serious findings are re-fired against a control, and every finding carries evidence. Fix it, then the retest replays the proof to confirm.

Before you scan

The questions security teams ask first.

Will it break my site?
Non-destructive by default: rate-limited, no denial-of-service tests, and a guard on anything that could change data.
What are we allowed to scan?
Only domains you verify. Scope is checked before every scan.
What happens to our data?
Encrypted at rest, secrets never logged, and payloads are redacted before they reach our LLM sub-processors. Read the security page.
Will my auditor accept it?
Findings are mapped to SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, NIST and OWASP, ready for your evidence file.
How does it compare to a manual pentest?
Minutes instead of weeks, evidence on every finding, replayable proof on what we reproduce, and retests that replay it. For complex business logic, pair it with a human-led test.

Accuracy

Proof, not guesses.

Zero false positives on our published control targets, enforced on every release.

Serious findings can be independently reviewed by models from two different AI labs. If they disagree, we flag the finding for verification instead of stating it as fact.

Every scan writes a tamper-evident coverage ledger: what was tested, and what was inconclusive. Blocked is never reported as clean.

See our published, gate-verified accuracy →

Pricing

Free to start · from $2,500 per full test.

Run a quick external scan on a domain you own at no cost. Full tests add authenticated, internal and deeper coverage.

See pricing →

See your own second face.

Only domains you own and verify.