Fleuret

• Running an authorised pentest of a SaaS web app and its API ahead of a SOC 2 or ISO 27001 audit
• Producing NIS2 or DORA testing evidence for a regulated EU company without a multi-week consulting engagement
• Testing cross-tenant access control (IDOR) and authentication flows with per-role test accounts
• Pushing confirmed findings to Jira or Linear, fixing them, and re-testing before closing the ticket
• Running continuous SAST, SCA, secret scanning and DAST on the free Platform plan between pentests
• Checking a domain's public exposure with the free Cassini check before scoping a pentest

Fleuret is less a tool you operate than a priced pentest engagement delivered by agents: you hand over scope, test accounts and an authorisation, and get back proven findings in a ticketing workflow plus a report your auditor can file. That suits European mid-market teams whose real problem is compliance evidence on a deadline, and the EU hosting and open-weight models matter to regulated buyers. The open-source agents in this category give engineers more control and run in CI, but leave the reporting, scoping and re-testing to you. Before buying, check that your audit only needs web, API and external infrastructure coverage, and ask how much human review sits behind each engagement.

About Fleuret

Fleuret sits between a traditional pentest firm and an automated scanner. You hand it a scope (URLs, plus an API specification if you have one), test accounts for each role you want tested, and a signed authorisation that defines what is in and out of scope and the testing window; Fleuret says it never tests a system without written authorisation from its owner, and its terms limit the service to assets you own or are authorised to test. An orchestrator called Émile then maps the attack surface and dispatches short-lived specialist agents, each focused on one attack vector such as authentication, access control (IDOR), injection, business logic or privilege escalation, and retired after its mission. A separate validation engine turns a suspicion into a finding only after a controlled, read-only challenge confirms it is exploitable, and a Coverage Graph tracks which endpoints, parameters and auth contexts have been tested so the system can decide when the pentest is complete. Fleuret's launch announcement names a second agent, Champollion, alongside Émile, but the platform documentation only describes Émile's architecture. Fleuret describes the service as AI agents combined with human offensive expertise, and says a flat price works because most of the work is compute plus a bounded amount of expert time. Results land in a findings workspace rather than only a PDF: each finding has the exact request, the affected path, a severity, a replayable PoC and a remediation, can be pushed to Jira, Linear or Slack, and can be re-tested after a fix. The one-off pentest report is mapped to DORA and NIS2, and Fleuret's FAQ explains how it also serves as evidence for ISO 27001 and SOC 2, while stating that it is audit evidence, not a certification, and that it does not replace a DORA threat-led penetration test (TLPT). Data residency is a central part of the pitch: findings and reports are hosted by Scaleway in Paris, and the open-weight models (gpt-oss and Kimi K2.5) run on Scaleway GPUs in France, with no calls to third-party model APIs. Fleuret's funding announcement names Brevo, Stoïk and Yogosha among its customers. The tradeoffs: it is a hosted commercial service with no open-source or self-hosted option, scope today is limited to web apps, APIs and external infrastructure (Active Directory, mobile and cloud pentests are on the roadmap), there is no public product documentation beyond the website and FAQ, and the €4,000 price is per web app, so teams with many applications move to Enterprise pricing on quote.