Hacktron

• Running a white-box pentest of a SaaS application before a SOC 2 or ISO 27001 audit and handing the auditor the executive report and attestation letter
• Putting a security check on every pull request so exploitable access-control and logic flaws from human or AI-written code are caught before merge
• Letting an agent turn new high-severity findings into tested fix pull requests for engineers to review
• Scheduling repeat Whitebox scans of a critical service each quarter and gating releases on the results through the API
• Pentesting sensitive source code inside your own network with the on-premises appliance
• Engaging continuous red teaming of external services, identity and SaaS connections to find multi-step attack paths that a single-app pentest would miss

Hacktron's distinguishing move is pairing two products that are usually bought from different vendors: an always-on PR security reviewer and a priced-up-front white-box pentest with human validation and auditor paperwork. For a SaaS company that needs both a pentest report this quarter and fewer exploitable bugs in every merge, that is a coherent package, and the self-serve pricing makes it easy to try on one repository. Its research record, from remote code execution bugs in PHP, Node.js and Metabase Cloud to the OpenAI chain, is the main evidence that the agents find real issues, though that record is mostly self-published. The fit is narrower than the 'whole organisation' Red pitch suggests: Red is a sales engagement with little public detail, so most buyers will be evaluating Whitebox and Review. Teams that only want black-box testing of web apps at portfolio scale will find XBOW a closer match, and teams that want an open-source white-box pentester they run themselves should look at Shannon or Strix.

About Hacktron

Hacktron is built by security researchers and sells one platform in three motions. Whitebox is a scoped pentest of one application: you connect a repository from GitHub, GitHub Enterprise Server, GitLab, Azure DevOps or Bitbucket (or give a public repository URL or upload an archive), narrow the folders in scope, optionally add staging URLs with test-account sign-in steps that Hacktron verifies in a live browser preview, and attach architecture notes or threat models. You see a credit estimate based on code size before anything starts (the public price list says $50 to $25,000, about $500 per 100,000 lines of code, with codebases above 5 million lines quoted separately). Agents trace untrusted input through the code, test each candidate in an isolated sandbox or against the deployed app, and Hacktron's researchers validate findings before you get a full technical report, an executive report, one free retest and, on request, an attestation letter that you can use as pentest evidence for SOC 2, ISO 27001 or customer security reviews. Review is the continuous counterpart: it posts a security check and line comments on every pull or merge request, builds call graphs so it can flag a vulnerability outside the changed lines, maintains an editable threat model, and fails the check on serious findings until they are fixed or triaged. It is billed per developer seat from $40 a month with a 14-day trial, and is free for qualifying open-source projects. Automations hand matching findings to an agent that confirms the bug, writes a fix, runs your tests and opens a pull request, paid from a separate credit balance. Red is a custom engagement in which researchers and agents continuously map and attack your external services, authentication, SaaS providers and supply chain, report proven attack paths with evidence for each step, and rerun the attack after a fix. Whitebox and Review are also reachable through a REST API, an MCP server and a Slack assistant, and an Enterprise appliance runs in your own network, including air-gapped environments. The company's credibility comes largely from its published research, including a September 2026 write-up of an exploit chain into OpenAI employees' ChatGPT and Codex accounts, reported through OpenAI's bug bounty program and followed in November 2026 by a security partnership with OpenAI. The tradeoffs: Red has no public price or self-serve path, Whitebox and Automations are prepaid credit products you have to watch, Review caps changes at 500 files and pooled PR allowances per seat, and the platform is closed source.