Matproof Sentinel
Pentest-style evidence in hours, not weeks.
Sentinel runs ten specialised AI agents across your code, APIs, and infrastructure - chaining vulnerabilities like a real attacker, then re-testing each finding before it lands in the report. Findings it cannot confirm are marked as unconfirmed. Each finding lands as a GitHub issue and is pre-mapped to SOC 2 (CC7.1), ISO 27001 (A.8.8), the DORA Art. 24-25 testing programme and NIS2 Article 21.
No signup for the 3-min scan — your first findings in your inbox. Full Sentinel pentest from €299/mo, cancel anytime.
How Sentinel works
Three steps to a complete pentest
Step 1
Install the GitHub App, set your scope
One-click install of the Matproof Sentinel GitHub App - read-only, scoped to the repos you select. No third-party OAuth approvals, no PATs sitting in env files. Bitbucket, GitLab and plain target URLs are supported too. A single scan can cover one primary target plus up to 50 additional URLs. Domain ownership is verified via DNS TXT or HTTP file challenge before any traffic is sent.
User access review
Step 2
Ten AI agents scan in coordinated stages
Recon (nmap, amass, httpx) maps the surface. Web, API, Infra, Cloud and Mobile agents probe in parallel (nuclei, sqlmap, OWASP ZAP, testssl.sh, Prowler, MobSF). Source-code and supply-chain agents read your repos (Semgrep, Gitleaks, Trivy). A ValidatorAgent re-tests every finding and marks it confirmed, unverified or false positive. Median scan: 25 minutes. Full agent registry and methodology at docs.matproof.com.
Findings
3 open · 1 verifiedCorrective action
Step 3
Report, SARIF, GitHub issues, remediation diff
Every finding ships three ways: a PDF report as evidence for your SOC 2 / ISO / DORA file, SARIF for GitHub Advanced Security, and auto-created GitHub issues routed to the right team. Re-tests dedupe via stable fingerprints and surface a hero metric: "N findings remediated since your last scan" - the receipt your auditor and your board actually want.
Mapping queue
Controls
Evidence
Platform
Full-stack security coverage
AI agents test every layer of your application - from frontend to infrastructure.
Web, API & DAST
WebApp + Browser + API agents
Crawls every endpoint, form, and route. Tools include nuclei, sqlmap, ffuf, jwt_tool, OWASP ZAP and OpenAPI/GraphQL fuzzing. Covers OWASP Top 10 + API Top 10, auth bypass, IDOR, DOM XSS, JWT flaws and session-management issues. Authenticated scans supported via session cookies or bearer tokens.
Source Code & Supply Chain
Semgrep + Gitleaks + Trivy
SourceCode and SupplyChain agents read the repos you connect via the GitHub App. Semgrep for SAST, Gitleaks for hardcoded secrets, Trivy for vulnerable dependencies, containers and IaC. Findings cross-reference CVE feeds and ship with fix-patch suggestions.
Infrastructure, Cloud & Mobile
nmap + testssl.sh + Prowler + MobSF
Recon (nmap, subfinder, amass, dnsx, httpx), TLS/DNS hardening (testssl.sh), AWS auditing via Prowler when you grant a read-only STS role, and MobSF for Android / iOS binaries. Covers exposed ports, IAM misconfigurations and privilege-escalation paths.
Remediation
From issue to fix in minutes
Discover
Ten AI agents systematically work your attack surface in coordinated stages - one primary target plus up to 50 additional URLs per scan. SQL injection in your API, misconfigured S3 buckets, leaked secrets in your repo, vulnerable container images.
Auto-validate
A dedicated ValidatorAgent re-tests every finding before it ships. Each finding is marked as confirmed or unconfirmed, so your team knows what to fix first.
SARIF export to GitHub Advanced Security
Every scan ships as a SARIF 2.1.0 report — upload directly into GitHub Advanced Security, GitLab, or Azure DevOps security dashboards. Findings land in your existing PR review workflow with stable fingerprints so retests deduplicate automatically.
Why teams trust Sentinel
Every finding is re-tested before it reaches you.
Each finding is re-tested. Unconfirmed findings are marked as such, so you see what is proven and what needs a closer look.
Reproduction steps
Each finding ships with reproduction steps and the evidence the agent collected. Confirmed findings show how the agent reproduced them.
Auto-Triage
AI classifies severity using CVSS and business context, so your team fixes what matters first - and skips noise that scanners normally promote.
GitHub-native workflow
Findings land as auto-assigned GitHub issues, labelled by severity, with repro steps and a suggested fix patch. Stable fingerprints dedupe across re-tests and surface a remediation-diff metric: "N findings remediated since your last scan" - the receipt your board actually wants. SARIF export for GitHub Advanced Security included.
Open methodology, honest scope
Full Sentinel methodology - every agent, every tool, every check - public at docs.matproof.com/features/sentinel-methodology. We also publish what Sentinel does NOT do: no social engineering, no zero-day discovery, no human verification. Buying honesty, not vapour.
Evidence report
Findings auto-tagged to SOC 2 (CC7.1), ISO 27001 (A.8.8 / A.8.29), DORA (Art. 24-27), NIS2 (Art. 21), PCI DSS (Req. 11.4), HIPAA (§164.308(a)(8)), BaFin MaRisk/BAIT and NEN 7510. PDF, JSON and SARIF - drop straight into your auditor's evidence room.
Re-tests show what you fixed
Run Sentinel again after a fix. Stable fingerprints match findings across scans and show which ones are closed.
Deployment fingerprinting
Sentinel pinpoints the exact git commit and branch running on your target — and flags stale deployments, un-merged code shipped to production, and exposed .git directories.
Testing modes
Choose your approach
Black-box Testing
External-only testing with no source code access. AI agents attack your application the same way a real attacker would - through your public-facing endpoints, APIs, and infrastructure.
- No source code needed
- Tests external attack surface
- Faster scan times
- Simulates real-world attacks
White-box Testing
Full source code review combined with dynamic testing. AI agents analyze your codebase line by line, then re-test each finding against the running app. This is the most comprehensive approach.
- Full source code analysis
- Finds hidden vulnerabilities
- Deeper coverage
- Merge-ready fix PRs
Grey-box (authenticated)
Provide a login — including behind SSO, 2FA, or Cloudflare Access — and Sentinel tests the authenticated surface that black-box scanners never reach, where most real breaches happen. Read-only by default; credentials are encrypted and deleted after the scan.
- IDOR / BOLA — reach another user's data
- Privilege escalation & access-control bypass
- Session & JWT weakness analysis
- Read-only by default — safe on production
Real findings, not guesses
Built on the tools security teams trust
Sentinel orchestrates the same battle-tested tools professional pentesters rely on — so every finding is reproducible and stands up to your auditor. No black-box AI guesswork.
Complete coverage — OWASP Top 10 · OWASP API Security Top 10 · Authentication bypass — mapped to SOC 2, ISO 27001 & DORA.
Pricing
Simple, predictable pricing
Includes 3 pentest runs per month.
Additional runs at €149 each.
- Web, code, and infrastructure scanning
- Re-tested findings with reproduction steps
- Evidence for SOC 2 and ISO 27001
- SARIF export for GitHub / GitLab / ADO
- Black-box and white-box modes
- Continuous monitoring & alerts
Available as an add-on to any Matproof plan. Cancel anytime, no procurement loop.
Need unlimited targets, Cloud + Mobile + SupplyChain agents, SSO or a dedicated CSM? Talk to sales →
Frequently asked questions
What is AI penetration testing?
AI penetration testing uses autonomous AI agents to probe your applications, APIs, source code, and infrastructure for security vulnerabilities. Unlike traditional pentests that rely on manual effort over weeks, AI agents can test thousands of attack vectors in hours. Each finding is re-tested, and the report gives evidence you can show your auditor.
How long does a scan take?
Median scan finishes in 25 minutes thanks to parallel agent execution (Recon runs first, then Web/API/Infra/Cloud/Mobile in parallel, then Source-Code/Supply-Chain, then the Validator re-runs each finding). Larger surfaces with many subdomains or large codebases can run longer, up to a few hours. You receive results as findings are confirmed - no need to wait for the full scan to finish.
Is this compatible with SOC 2 and ISO 27001 audits?
Yes, as evidence. Reports give evidence for SOC 2 CC7.1 and ISO 27001 Annex A.8.8 (management of technical vulnerabilities). Each finding includes CVSS scoring, reproduction steps, evidence and remediation guidance. Your auditor decides what is sufficient for your scope.
Is it safe to run against production?
Yes. Sentinel tests in a safe way by default. It checks SQL injection in detection mode only and never extracts or dumps database records. It shows XSS with a harmless marker. Authenticated scans are read-only unless you turn on active mode. Each finding is re-tested and comes with the request and response as proof. Before any traffic is sent, Sentinel requires you to prove domain ownership via a DNS TXT record or HTTP file challenge, so it can't be pointed at a target you don't control. You can also run scans against staging.
How does Sentinel compare to a traditional pentest?
Sentinel does not replace a human red-team engagement with social engineering, zero-day research or deep custom business-logic abuse. We say that plainly on the methodology page. It covers routine vulnerability discovery on your external surface, at €299/month instead of the €15,000-50,000 a typical engagement costs. It can also run continuously, not only once a year before an audit.
What types of vulnerabilities do you find?
Sentinel tests the external surface of your web apps, APIs and infrastructure. That covers the OWASP Top 10 and API Top 10, for example injection, broken access control, IDOR, XSS, JWT and session flaws. It also checks TLS and DNS settings, exposed ports and files, and known CVEs in public components. With repo access it scans source code, secrets and dependencies. With a test login it runs read-only authenticated tests, such as access between two accounts. It does not test your internal network and does no social engineering.
Do I need to give you source code access?
No. You can run black-box scans against any URL or IP without source code - one primary target plus up to 50 additional URLs per scan. For deeper coverage, install the Matproof Sentinel GitHub App (recommended), or connect GitLab / Bitbucket via OAuth, or paste a GitHub PAT. The App is read-only and scoped to the specific repos you select - no third-party OAuth approval friction.
Can I use this for DORA TLPT requirements?
No. Sentinel is not TLPT. TLPT is set out in DORA Art. 26 and needs qualified external testers and threat intelligence. Sentinel supports your Art. 24-25 digital operational resilience testing programme, for example with vulnerability scans and regular re-tests between TLPT cycles.
Get started
Stop guessing. Start testing.
Install the Sentinel GitHub App, point it at your repos, and get a re-tested findings report in hours. €299/mo, 3 scans included. No setup calls, no procurement loop.