From $50K Pentests to $100/month: What I Learned Building a Security Product Nobody Asked For

Two years ago I was quoted $38,000 for a penetration test of a web app with maybe four thousand users.

The engagement would start in six weeks, run for ten working days, and produce a PDF. By the time that PDF landed, we would have shipped roughly forty deploys against the version they tested.

I paid it, because an enterprise customer put it in the contract. That is the honest reason most small companies buy a pentest, and it is worth saying out loud before anything else in this post: security testing is bought under procurement pressure far more often than it is bought out of conviction.

What bothered me was not the price. Skilled testers are worth that money and the report was good. What bothered me was the shape of the thing. We were paying for depth once a year on a product that changed every day, and everything in between was covered by a scanner that produced four hundred findings and told us essentially nothing about whether one customer could read another customer's data.

So I built Penetrify, which runs AI agents that log into an application with real credentials and try to break it, then report only what they managed to prove. The Starter plan is $100 a month. This post is about what happened after that, including the parts that did not work.

The technical bet, stated plainly

A traditional scanner is a matching engine. It sends requests, compares responses against a signature database, and reports matches. It is genuinely good at that, and it is structurally blind to the thing that matters most, which is authorization. A scanner does not know that the number in your URL is an invoice ID, or that invoice 4471 belongs to a different company.

The bet was that an agent loop could close that specific gap. Not replace human testers, close one gap: log in as user A, build a model of what objects exist and who owns them, log in as user B, and go try to violate those boundaries. Report only what it actually retrieved, with the request and the response attached.

The bet mostly paid off technically. Across our aggregated dataset of 47,291 exploitation-validated findings from 3,847 applications, broken access control turned up in 42 percent of tested applications, and authenticated scans found 3.4 times more issues than unauthenticated scans of the same targets. Those numbers are published under an open license on our stats page so anyone can argue with them.

The 3.4x figure is the whole product thesis in one number. Most tools stop at the login page, and most of the risk lives behind it.

The part I got wrong: distribution

Here is where the honest founder content starts.

I spent the first months of distribution on paid ads, because ads are legible. You put money in one end, you read a dashboard at the other end, and it feels like progress. Between early July and early August I spent $321 on Reddit Ads and about 11,400 CZK, roughly $500, on Google Ads.

Attributable conversions from that spend: zero.

Not "poor ROI". Zero. Reddit reported 2,688 clicks and did not register a single page visit on our side, which is not a performance result, that is broken attribution. Google Ads recorded exactly one conversion event ever across the whole period.

Meanwhile the first three people who actually paid us arrived in a single week from organic search, landing on unglamorous comparison pages like "alternatives to X" and "what does Y cost". Total revenue from those three: $207. Not a triumph. But it came from pages I wrote in an afternoon rather than the channel I was pouring money into.

Two lessons I would give to anyone shipping a B2B tool:

Comparison and pricing pages outperform everything else at the bottom of the funnel. People do not search for your category, they search for the competitor they already heard of, plus the word "alternative" or "pricing". Those pages are cheap to write, they rank, and the traffic arrives already trying to buy something.
Instrument attribution before you spend a cent on ads. I ran ads for weeks while completely blind. When I finally dug into the raw CDN logs instead of the ad dashboards, I found that our analytics were gated behind a cookie consent banner that most visitors simply ignore, so anyone who did not click the banner generated no event anywhere. Every dashboard I had been reading was measuring consent rates, not customers. That is an embarrassing thing to discover in month three, and I would bet a lot of small SaaS teams have the same hole.

The thing that actually produced the biggest sale

Our largest single transaction so far came from a boring automation, not from a campaign.

Someone signed up, created no application, and went quiet. Three days later an automated re-engagement email went out. Four days after that they came back, ran the free security grader on their domain, got a grade of B, bought a scan two minutes later, ran it, and bought a larger pack one minute after that.

The free grader is the part I would build first if I started again. It is a five minute surface read of a domain's TLS setup, headers, and cookie flags, published at penetrify.cloud/en/security-check. It finds nothing deep and it is not an assessment. What it does is turn an abstract worry into a specific letter grade on your own domain, which is a completely different psychological object. Nobody buys security because they should. They buy it because they saw something concrete about their own product that they did not like.

If your product solves a problem people know they have but cannot see, give them a way to see it for free in under a minute.

What "$100 a month" actually changed

The pricing shift is not really a pricing shift, it is a cadence shift.

At $38,000 an engagement you test once a year. At $100 a month you test whenever you ship something that touches permissions, which is the only cadence that matches how software is actually written. The report is worth less individually and much more in aggregate, because it describes the application that exists today rather than the one that existed six weeks ago.

The honest limitation, which I put in every sales conversation: this does not replace a human engagement when you have a genuinely novel architecture, and plenty of SOC 2 and ISO 27001 auditors will not accept an automated report in place of a manual one regardless of how thorough it was. If compliance is your driver, ask your specific auditor what they accept before you buy anything from anyone, including me.

Where things stand

Three paying customers, all one-off packages, zero subscriptions so far. First live payments arrived at the end of July. The product works better than the business does, which I suspect is the default state for technical founders and is not a comfortable thing to publish.

What I would tell myself a year ago

Build the free diagnostic before the paid product, not after.
Write the boring comparison pages in week one. They compound and ads do not.
Do not spend on acquisition until you can prove, from your own server logs rather than a vendor dashboard, that a click became a session.
The automated follow-up email you keep postponing is worth more than the campaign you keep optimizing.

Happy to answer anything about the agent architecture, the pricing model, or the attribution mess in the comments. The mistakes are more useful than the wins at this stage, and I have more of them.

Viktor Bulanek is the founder of Penetrify, an autonomous penetration testing platform for development teams, based in Brno, Czech Republic. The vulnerability statistics cited come from an aggregated dataset published under CC BY 4.0.