Gadfly runs an AI-agent pentest against your public-facing web apps and APIs. The model runs inside your own environment, every critical finding is confirmed by a person, and if we confirm none, the engagement is free.
No call needed to see a sample report.
app.example.com:443Allowapi.example.com:443Allowstaging.example.com:443Allow*Drop100%
of criticals are confirmed by a person before they reach you
0
third-party model calls — the model runs inside your environment
No fee
if we confirm nothing critical in your scope
1 free
retest of fixed findings in every engagement
The agents and the model run in your own data center, or a dedicated cloud account we create for the engagement and destroy when it ends.
Your traffic, targets and findings never leave your boundary. Nothing is sent to a third-party model API, and we keep no copy afterward.
We agree a fixed fee up front. You owe it only when we confirm at least one critical finding. If we confirm none, the engagement is free.
Agents propose; a human tester reproduces and confirms. Nothing reaches you as critical on a model's word alone.
Request GET /api/…/{id} [redacted]
Response 200 OK expected 403
Asset api.example.com
Captured 14:07:52 ISTEach finding carries the request and response that prove it, the affected asset, and remediation notes. Only criticals surface by default, so the report stays readable.
You shipped fast and something customer-facing is exposed. One scoping call, a fixed window, and you pay only if we confirm something critical.
Every finding carries the request and response that prove it, and notes your team can act on. No wading through a scanner's three hundred maybes.
The model runs inside your boundary. Nothing goes to a third-party API, nothing is pooled with other clients, and you hold the only record when it ends.
Written authorisation, a defined scope, and a report you can hand to an auditor or drop into a customer's security questionnaire.
First, the scope is signed.
Then agents run, constrained.
Findings are confirmed.
You fix. We retest, free.
Gadfly is named for the fly Socrates compared himself to: small, persistent, and useful because it keeps a large animal awake. That is the job. We test ordinary web applications and APIs, the kind that carry logins, invoices and customer records. We do not red-team LLMs or test AI agents. We do not sell a self-serve attack console, and there is nothing to download and point at a target. Every engagement starts with written authorisation and rules of engagement; without them, nothing runs. The agents make the work faster and broader. They do not replace a penetration test, and a person reviews every critical finding before it reaches you.
The button opens the contact form with your answers filled in. We reply within one working day to arrange a 30-minute call. Nothing is tested until rules of engagement are signed.