AI-Native Pentest (AI-PTaaS)

Yes, and we own it. Let's separate two things. EASM discovery and scanning are non-intrusive by design: no exploitation, no destructive payload, redirects disabled, per-host rate capped, three-layer anti-SSRF guard. AI validation, on the other hand, is active testing: it runs real tooling (sqlmap, nuclei and others) against the live asset, which can change its state. The sandbox isolates the tooling (ephemeral container, egress filtered to the target's public IPs only), not your asset. That's why it is manual, reserved for critical findings on a domain you have verified, and quota-limited. We'd rather say it than hide it.

A difference in kind. The agent is AI: it confirms, or not, that a High or Critical finding is exploitable with standard tooling, under strict guardrails (20 steps, 300 seconds, 150,000 tokens). It doesn't do twisted business logic, no creative exploitation chain, no human judgement on your application's context. An OSWE-certified pentester chains weak vulnerabilities into full compromise, understands your business and thinks like a determined attacker. The two are complementary: AI validation lowers the noise at scale, the pentest brings thorough human verification. They are two separate offerings, and we don't pretend one replaces the other.

Validation calls Anthropic's Claude models through Google Cloud Vertex AI, in a European region, under standard contractual clauses. No training on your data, no retention to improve a third-party model. Your findings, the exploitability proofs and the rest of your inventory stay under European law, isolated per account, with secrets masked before they are written. Handing an exploitability proof to a US vendor exposes it to extraterritorial access requests, at odds with GDPR and NIS2: we keep hosting in the EU.

No, and be wary of anyone who does. Validation confirms a finding when the agent manages to actually exploit it: that case, you can believe, proof in hand. But a validation failure doesn't mean the finding is a false positive: the agent didn't prove exploitability with its tooling and within its bounds, that's all. We don't overread failure, we don't turn absence of proof into certainty. What validation saves you is the most expensive triage: telling what is proven exploitable apart from what still needs investigating.

The same offensive tooling a human operator would use: sqlmap for SQL injection, nuclei for exploitation templates, and the rest of the kit depending on the finding type. The agent picks its tools based on the vulnerability and runs them for real in the sandbox. It's not another scan pass nor a finer CVE correlation: it's an exploitation attempt, with real tools, against the affected asset.

Manually, from the interface, only on a High or Critical finding from a domain whose ownership you have proven. Nothing fires automatically, because it's active testing. Each validation spends one credit of your monthly quota, shown in real time. You choose the finding and the moment; the scope stays strictly yours.

2 validations a month on Discovery, 30 on Pro, 100 on Business, unlimited on Enterprise. Credits are counted per calendar month and reset on the 1st. AI-native validation is included in every EASM tier, with growing quotas: it's not a module sold separately, it's a facet of the platform.

It stops, cleanly. The guardrails are hard: 20 steps, 300 seconds or 150,000 tokens, the first limit reached ends the validation. The ephemeral container is destroyed, and the finding stays at detected if exploitation didn't succeed within the allotted frame. An autonomous agent without limits would be a risk; here the bound comes before the demonstration.

No minimum term. The subscription is monthly or annual (annual works out at ten months paid), renewed tacitly at each due date, and you cancel it at any time, with no justification to give: either you do it yourself from your billing area, or you write to contact@own2pwn.fr and the answer comes within 24 hours. No notice period to serve: cancellation takes effect at the end of the current billing period, and you keep access until then. In return, that period is not refunded pro rata. That is not a sales promise, it is article 7 of the terms of sale.

No. The Discovery plan opens from the sign-up form, with no payment method: no card to enter, no counter starting after fourteen days. It is not a trial but a free plan with no time limit and its own quotas (1 domain, 25 tracked assets, 10 scans per month). The AI-Native Pentest module is included in it, not sold separately. A card only comes into play if you move to a paid plan, and payment happens on own2pwn.fr, by card only.

Access opens immediately after the payment is validated. In practice: as soon as the payment is confirmed, the subscription is attached to your account and the plan quotas apply, with no manual step in between. If you subscribe without an own2pwn account yet, the payment creates one and you get an email to set your password: access is live as soon as that is done. If anything gets stuck, write to contact@own2pwn.fr, the answer comes within 24 hours.

Yes, and without starting over: the account, the domains you declared and the scan history stay in place, only the quotas change. Modules are never billed separately: AI-Native Pentest comes with the EASM subscription, so changing plan moves the quotas of every module at once. You request the change by email to contact@own2pwn.fr, stating the plan you want and the date it should take effect; the answer comes within 24 hours. What is settled on the billing side is that the period already paid for is not refunded pro rata (article 7 of the terms of sale); the exact amount and the effective date of the new plan are confirmed to you in writing before anything is validated.

When the agent confirms, it keeps a trace: request, response, path taken. The proof is redacted before it is written (secrets and tokens masked), so you can review it, show it to a team or attach it to a ticket without copying sensitive data. A confirmed finding arrives with something to believe, not just a green label.