Continuous cybersecurity for your SaaS.
Continuous pentesting and vulnerability management on the same platform, from discovery to confirmed fix.
Offensive Security
No high or critical finding, half the price.
On your first pentest with Haku, if no high or critical vulnerability is found, you get 50% off.
- FAQThe questions that come up before signing.
- IntegrationsWhere findings land in your team workflow.
- Due diligenceThe evidence a buyer asks for.
- Vulnerability ManagementWhat the platform does on the inside.
- DeliverablesWhat reaches your hands at the end of the pentest.
- How it worksFrom kickoff to the results presentation.
How it works
From kickoff to the results presentation
Every pentest sprint starts with an alignment meeting and ends with the findings live on the platform, not in a PDF sitting still.
Kickoff
Scope, targets, window and rules of engagement defined.
Platform access
Your team tracks the fix, the due date and the retest, with history for every vulnerability.
Mapping
Enumeration of the attack surface, identification of technologies and versions, subdomains, directories and exposed endpoints.
Execution
Identification and exploitation of vulnerabilities.
Results
Technical description, proof of concept and remediation guidance, presented in a call with your team.
Retest
Validation of the applied fixes, with evidence recorded and the status of every vulnerability updated on the platform.
Deliverables
What you get at the end of the pentest
Every vulnerability documented end to end.
No “just fix it”. Your team gets enough to reproduce, prioritise and resolve without coming back with questions.
- Title and description
- what the flaw is, in language a product team understands
- Severity and CVSS v3.1
- scored classification, not opinion
- Related CWE
- the type of flaw, referenced against the industry standard
- Proof of concept
- a reproducible walkthrough, not a loose screenshot
- Business impact
- what an attacker can do, as consequence and not as jargon
- Remediation guidance
- the technical path, with a reference where one exists
Haku platform
A complete vulnerability management platform, with dashboards, a findings inbox, priority assignment, SLA and much more.
Execution attestation
A formal document proving the pentest was carried out, identifying Haku as the executor. It is what you present when a client or an audit asks for evidence.
Verifiable digital badge
A public Haku page with a validation code and QR code that anyone can check in seconds.
See an exampleResults presentation
A meeting where Haku presents the assessment results, details the vulnerabilities found, justifies the severity assigned and advises on remediation strategies.
Vulnerability Management
Inside the platform
What happens to a vulnerability between the finding and the closure.
Inbox and kanban on one queue
Two views of the same pipeline. The inbox to handle one at a time, the kanban to see where the queue is stuck.
Validation before engineering
A pentest finding reaches your team already reproduced, with severity set and a proof of concept. What becomes a priority is what is real.
A due date per phase, not one for everything
SLA is set per stage of the cycle. You see what slipped in validation and what slipped in remediation, separately.
Retest with evidence before and after
The fix is confirmed by testing, not by someone saying it was fixed. Before and after stay attached to the finding.
Severity with who decided and why
Every severity change keeps the previous value, the new one, the author and the rationale. Disagreement over criticality is settled on the record, not from memory.
An audit trail nobody edits
Every status change is recorded with author and date, and the database refuses any edit or deletion of that history.
Due diligence
Show security maturity to clients and investors.
Recurring pentest with documented scope and methodology, plus the history of every vulnerability through to the fix. An objective base for due diligence, client reviews and enterprise contracts, with nothing to prepare the night before.
Due diligence
Evidence for audits
Pentest
Scope and methodology
Severity
CVSS v3.1, not guesswork
SLA
Due date per phase, measured
Trail
Decisions on record
Integrations
Connect to the workflow your team already uses
Findings land where your team already works: connect signed webhooks to Slack, Jira, Teams, Discord, or your own internal systems.
Don't see your tool? Anything that accepts webhooks can be wired in.
Pentest for SaaS
What is a pentest?
If nobody on your team has hired one before, the pentest page starts from scratch: what the test does, why it now comes up before the contract and how Haku runs yours.
Read the full pageWhat it is
The test explained through the questions an attacker asks your product.
Why it matters
Why the people who built the product cannot see what an attacker sees.
Methodology
The six fronts the assessment covers, and what each one looks for.
First pentest
No high or critical finding and you pay half the price.
FAQ
Frequently asked questions
Short answers; details across the rest of the page and in the product.
What is continuous pentesting, and why not one test a year?
One test a year photographs a product that changes every week. In a continuous cycle, each round covers what shipped since the last one, and whatever was fixed goes back for a retest. Every vulnerability keeps its history on the platform, so you compare round to round instead of starting over.
How long does it take, from kickoff to the results presentation?
It depends entirely on the scope. It can run from a week to a month or more, depending on the size of the surface, the number of authenticated flows and the rules of engagement. The timeline is agreed with you at kickoff, before any testing starts.
When does the 50% discount apply?
On your first pentest with Haku. If no high or critical vulnerability is found, you pay half the price. Severity is classified by CVSS v3.1 Base Score, the public standard any auditor can check. It applies once, on the first contract.
What exactly do I get at the end?
Every vulnerability documented end to end: title and description, severity by CVSS v3.1, the related CWE, a reproducible proof of concept, business impact and remediation guidance. Alongside it come platform access, the execution certificate and the results presentation with your team.
See the deliverablesWhat happens when my product changes after the test?
That is what the continuous cycle covers. Each new round runs over what changed since the last one, and whatever was closed stays in the history, with the date and author of every status change.
How does my team track what is open and the deadline on each item?
Inbox and kanban over the same queue: the inbox to work through them one by one, the kanban to see where the queue stalled. Each stage of the cycle has its own SLA, so what slipped in validation shows up separately from what slipped in remediation.
Does it connect to Jira, Slack or our internal system?
Yes, through signed webhooks. Slack, Jira, Teams, Discord or any system that accepts a webhook. Findings arrive where your team already works, without forcing anyone to open another tab.
Can I get just the results, without working inside the platform?
Yes. Nothing forces your team to run remediation inside Haku: the vulnerabilities are documented and presented on a call either way. The platform comes along because that is where the remediation cycle and the retest are recorded, but where the work happens is your call.