Find, prove and fix.
Émile runs human-grade pentests on your applications, APIs and infrastructure, ships a replayable exploit with every finding, and Hortense tells you what to test next, and when.
Watch Émile work a full engagement.
Several agents test your surface at once, drop the leads the evidence does not support, and reproduce every finding before it is reported. No slides.
Illustrative run on a fictional target · not a live scan
Every pentest
has a fencer.
His name is Émile.
- 01En gardeYou sign the scope. He never leaves it.
- 02AttaqueSpecialist agents chain real exploits.
- 03TouchéReplayable PoC, or it is not reported.
Great mustache. Greater findings.
- 01 · Prove
Is it exploitable on your system, or only on paper?
Every finding ships with a working, replayable exploit. If it cannot be reproduced, it is not in your report. What was tested and held is in there too, so your auditor reads both halves.
0findings without a PoCNo proof, no finding. Signed report, coverage included.
- 02 · Fix
Findings you can assign, fix and verify. Not a 60-page PDF.
Each finding lands as a ticket with its exploit, an owner and a remediation, pushed to Jira, Linear or Slack. Fix it, re-test it, and export the signed report when the auditor asks.
- 03 · Find
Test again when you ship, not next January.
Launch a full pentest the day an app changes, and get results in hours, not in next year's audit window. Re-test a fix whenever you want.
Results in hours.Unlimited re-tests included.
Know what to test next, and when.
Hortense maps your estate from domain to database, crosses what changed in the code with what is exposed on the internet and what past pentests found, and answers three questions.
- 01What is exposed that I do not know about?
- 02What changed since my last pentest, and was it tested?
- 03Where should my next pentest go, and why?
- Web
- API
- External infra
- Code
- Exposure
- Pentest memory
Every pentest you run on Fleuret stays on her map. She advises, your team decides what runs.
Meet HortenseA full pentest. In hours. When your risk moves.
The depth of a consulting pentest, the rhythm of a scanner, and a working exploit behind every finding.
Consulting pentest
- deep
- 2 to 4 weeks
- once a year
Scanner
- minutes
- shallow
- noisy
Pentest by Émile
- deep
- hours
- when it changes
- proof on every finding
Your engagement data stays in Europe.
Hosting and inference on Scaleway in Paris: a European provider, not the EU region of a US hyperscaler.
- Models
Open-weight models (gpt-oss, Kimi K2.5) on H100 GPUs at Scaleway in Paris.
- Data
Engagement data does not leave that environment to reach a third-party model API.
- Clients
Full isolation between clients.
A full pentest from €4,000. Volume plans from €2,800 per pentest.
One pentest, or a yearly volume with Hortense, attack-surface monitoring, re-tests and EU hosting included.
Straight answers, with proof.
Will my auditor accept a report produced by Fleuret?
An auditor checks the method, and the method is in the report: a replayable exploit for every finding, logged re-tests, the coverage of what was tested and held, and a signed report mapped to DORA, NIS2 and ISO 27001.
Fleuret adds to the people already in place (your team, your MSSP, a PASSI-certified firm) and reinforces them. It tests every application, the ones they audit included, and Hortense keeps the dated coverage of each one on her map.
How is this different from a scanner?
A scanner matches signatures and reports what might be vulnerable. Fleuret executes each step of an attack and reports what it actually exploited, with a proof you can replay yourself.
That is why the report carries fewer false positives than a scanner export, and is usually shorter.
Could my team do this with an LLM and a few agents?
A model can suggest an attack. A pentest needs the rest: Émile maps your app like an attacker, sends specialist agents on one mission each, and a separate validator confirms every finding with a non-destructive exploit.
The orchestration is deterministic code, not a free-running model, and it ends in the signed report your auditor reads.
Is it safe on production?
Yes, by design. Proofs of concept are read-only and non-destructive: the validator demonstrates access without writing, deleting or degrading anything. Every request is traced and ships with the report, and we can test a staging environment instead.
How often should I test?
When something changes, not on a calendar. A release, a new host or a new finding shifts an application's risk: Hortense tracks it and tells you where and when a full pentest pays off, or that none is needed.
Re-testing a fix costs no credit.
Run your first pentest this week.
30 minutes with a founder. You describe your perimeter, we run the platform against it live, and you leave with a priced scope and a delivery date.