- 1Start
- 2Verify DNS
- 3Review scope
- 4Payment
- 5Your report
Test your website. Know what to fix next.
Up to 30 minutes of Strix testing on a website you own. Get recorded findings, evidence and next steps in a readable PDF.
$14.50
$29
Early-access price, 50% off
One website, one scan. USD, plus applicable tax. No subscription.
Setup and report preparation take additional time. You prove you own the site with a DNS record before paying. A scan that fails to test anything is refunded automatically.
- 00:00Isolated test environment started
- 11:43High: one customer could open another customer’s invoice
- 11:44Issue: a debug page showed internal settings
- 14:16Eight more checks finished, nothing found
- 16:42Report ready and emailed as a PDF
Includes: full vulnerability scan + AI pentest + human-readable report + AI fix prompts
This is more than a scan: an AI agent simulates a real attacker against your live app within the authorized scope. Automated testing only, with no human testing or authenticated testing.
Built for teams using Lovable, Bolt, Replit, Cursor and Supabase. Paste the fix prompts into your builder or editor, review the changes and verify them before deploying.
Deep Scan runs first, followed by Strix. You receive one combined PDF and the technical ZIP with ai-fix-prompts.md. If Deep Scan is unavailable, the pentest continues and the report explains the gap.
One website. One scan.
$14.50USD / scan
Early-access price, 50% off $29. Plus applicable taxes. No subscription.
- One exact, DNS-verified and approved HTTPS hostname.
- Up to 30 minutes of active testing; setup and report preparation take additional time.
- Detailed PDF and separate Strix technical ZIP.
- Email notification, private downloads and 30-day report-file storage.
- Assessment support and a published refund policy.
Human-led testing, authenticated-user testing, remediation and retests are separate. Coverage depends on the available time, model budget and testing constraints.
See what you’ll get
A report you can read.
Details your developer can use.
Start with the executive summary, then review the findings by severity. Each finding explains the affected area, potential impact, supporting evidence and remediation where the engine recorded them. Missing evidence and incomplete coverage are labeled.
- PDF: colorful summaries, readable findings and a practical review checklist.
- Strix ZIP: the exported technical report and structured results where produced.
- Private delivery: download in your account or follow the emailed report link.
The sample uses fictional lab data. It is not a result for your website.
What is Strix, and what does Protego add?
Strix is an open-source AI penetration-testing tool. Protego wraps its engine in an online service: account access, DNS verification, scope authorization, payment integration, constrained execution and readable reports. Protego is independently operated and is not the creator of Strix or endorsed by its maintainers.
The website guides you through five steps: start, verify DNS, review scope, pay, and receive your report. Scan jobs run on demand in isolated AWS CodeBuild environments, with DeepSeek V4.1 Flash served through Modal. You do not need Docker, a server or an AI API key.
Strix is licensed under Apache 2.0. The service fee pays for Protego’s hosting, execution and reporting. Strix license.
Before you start
What is Protego’s online penetration test?
Protego is an independent hosted service built around Strix, an open-source AI penetration-testing engine. It combines DNS ownership verification, scope authorization, on-demand AWS execution and readable reports. It is a time-bounded automated assessment, not a human-led penetration test or compliance certification.
What does a scan cost, and what does it include?
During early access a scan costs $14.50 USD (50% off the $29 list price), plus applicable taxes, with no subscription. It covers one approved HTTPS hostname, up to 30 minutes of active testing plus setup and report preparation, a detailed PDF, a Strix technical ZIP, the report by email and 30 days of private report-file storage. A scan that fails before testing anything is refunded automatically.
Do I need to install Strix or provide an AI API key?
No. Protego runs the assessment online in an isolated AWS CodeBuild environment and uses DeepSeek V4.1 Flash through Modal. No Docker installation, server or AI API key is needed. You need an account, a verified email, DNS access and authority to approve testing of the exact website.
Why do I need DNS verification?
A unique TXT record demonstrates control of the submitted hostname before ordering. Protego rechecks DNS before execution. DNS control does not replace legal permission: an authorized business representative must also approve scope and confirm any required hosting-provider permission.
How long does the test take, and can I leave the page?
Active testing runs for up to 30 minutes. Queueing, environment setup and report preparation take additional time, so 30 minutes is not a total delivery deadline. The wizard shows live job status. You can leave the page and return to your account, and a report-link notification is sent when the scan ends.
What files will I receive?
Your main download is a colorful PDF with an executive summary, severity overview, recorded findings, evidence and remediation where available. Your developer can also download a ZIP containing the exported Strix report and structured results where produced. Incomplete runs are labeled and may have only partial files.
Does a clean report mean my website is secure?
No. Automated testing can miss vulnerabilities or report false positives. Time, model budget, authentication and network restrictions limit coverage. A technical reviewer should confirm findings, choose appropriate fixes and retest. Human-led testing, fixing vulnerabilities and retests are not included.
For businesses testing websites they are authorized to assess. Need a quick configuration check instead? Try the free website vulnerability scanner.
Start with DNS verification ↑