Fleuret raises €4M to build Europe's AI pentester.

Find, Prove, and Fix.

Trusted by
  • Stoïk
  • Brevo
  • Yogosha
  • Fleuret
IDORSSRFGraphQL introspectionJWT confusionBroken object authRace conditionsMass assignmentOAuth misbindingPath traversalBusiness-logic abuseSQLiOpen redirectRate-limit bypassPrivilege escalationCache poisoningSubdomain takeover
PROOF · NOT PROBABILITY

A pentest that ends with evidence, not a PDF of maybes.

€4,000
per pentest

vs €15,000–€30,000 for a firm

0
findings without a PoC

we do not report what we cannot replay

100%
of your data, out of the Cloud Act

Findings hosted on Scaleway, Paris. A European provider, not a US hyperscaler's EU region.

The report is the platform

Findings you can assign, fix and re-test. Not a 60-page PDF.

A traditional pentest ends with a document. Fleuret ends with a workspace: every finding is a ticket with a replayable PoC, an owner and a remediation. Push it to Jira, Linear or Slack, patch it, re-test in one click. The signed audit PDF is generated on demand.

  • Replayable PoC on every finding
  • Synced to your tooling: Jira, Linear, Slack
  • Signed export, mapped to your framework
HOW IT WORKS · FIND, PROVE, FIX

From first request to signed report.

step010203/ 03
01

Find

Émile maps your app and API the way an attacker would, then chains what it finds. Every step is executed, never inferred from a scanner signature.

  • 142 routes mapped
  • IDOR → export
  • JWT → admin
02

Prove

Every finding carries a replayable PoC and a severity you can defend. If it is in the report, it was exploited.

  • PoC on every finding
  • Ed25519-signed PDF
  • DORA / NIS2 mapping
03

Fix

Each finding lands as a ticket, not a paragraph: the exact request, the affected path, a remediation.

  • Jira · Linear · Slack
  • 1-click re-test
  • fix history exported
NOT A FIRM · NOT A SCANNER · A PLATFORM

The depth of a firm. The speed of a scanner.

Consulting firm

Deep, but slow and expensive.

  • Cost€15,000–€30,000
  • Time to report2–4 weeks
  • False positivesrare
  • Depthdeep
FleuretWins 4 / 4

Both. On every release.

  • Cost€4,000
  • Time to reporthours
  • False positivesPoC on every finding
  • Depthdeep
Legacy scanner

Fast, but shallow and noisy.

  • Costcheap, noisy
  • Time to reportminutes
  • False positivesmany
  • Depthshallow

Transparent pentest pricing

Start free on your code, buy a pentest per web app, or cover every app under one contract.

Platform

Free/ organization

Scanners on your code today, no call and no card.

  • 2 users, 10 repositories
  • SAST, SCA and secret scanning
  • DAST and attack-surface discovery on your domain

No pentest included. A pentest is €4,000 per web app, bought separately.

Start free

FLAT PRICE, ANY SCOPE

Pentest one-off

€4,000/ web app

The depth of a 4-week manual pentest, delivered in hours.

  • Web app, REST / GraphQL API and external infrastructure
  • Business logic, authentication, large scope
  • Multi-step exploitation chains
  • Reproducible PoC on every finding, fewer false positives
  • DORA / NIS2 PDF report
  • Re-test included once your fixes ship
  • Delivered in hours, not weeks
Start free

Enterprise

On quote/ web app / year

Your pentests on demand, every app, one contract.

Everything in Platform, plus:

  • CSPM, AI review on every pull request and Jira tickets
  • A pentest quota per web app, launched whenever you want
  • Several web apps under one contract
  • Signed DORA / NIS2 audit PDF
  • Board-deck export for quarterly review
  • Dedicated CSM
  • Invoice, custom DPA and procurement
Talk to us

€4,000 against €15,000 to €30,000 for a consulting firm. Moving to Enterprise within six months? Your first pentest is credited in full.

BOOK 15 MINUTES · CET · NDA-READY

Run your first pentest this week.

15 minutes with the team. We scope it on your real perimeter.