Website penetration testing that proves every finding.
DMZ attacks your websites, web apps and APIs the way a real attacker would — from the outside or with your source code — and reports only what it could actually exploit, with a security score and a full report.
No false-positive noise
A finding ships only with a working, reproducible exploit.
Score 0–100 · grade A–F
One scale for every assessment, tracked scan over scan.
Hebrew & English
Dashboard, reports and emails in both languages.
Coverage mapped to the standards that matter
Why DMZ
Built for teams who need proof, not possibilities
Everything in the product is designed around one idea: only report what was actually exploited, and make the result easy to act on and share.
Exploit-proven findings
Every vulnerability is confirmed with a working, reproducible exploit before it reaches your report. No theoretical noise, no triage of guesses.
A security score you can track
Each scan ends with a 0–100 score and an A–F grade, weighted by severity and certainty, so posture is visible at a glance and over time.
New, recurring, fixed
Findings are fingerprinted across scans of the same target: see what is new, what is still open, and what you fixed since the last run.
Two reports for two audiences
A full technical PDF for your engineers, and a shareable summary for customers and auditors — methods, coverage and score without exposing findings. Verifiable online.
Predictable pricing
Source-aware scans are estimated from your codebase size before you start, you set a hard credit cap, and runs that fail before producing a report are never charged.
Hebrew and English throughout
Dashboard, reports and emails in both languages, fully right-to-left aware — switch at any time.
How it works
From hostname to report in three steps
No agents to install, no scanner to tune. Add a target, launch, read the report.
- 01
Add a target
Enter a hostname, or connect your source from GitHub or a ZIP. Prove domain ownership once with a DNS record or a small file — it takes a minute.
- 02
Configure and launch
Choose depth, scope and rules of engagement. For source-aware scans you see a credit estimate up front and set your own hard cap.
- 03
Get the report
Findings with proof, a score and grade, what changed since the previous scan — and a shareable summary you can hand to clients.
Two ways to test
Test from the outside, or with your code in hand
Both produce the same score scale and the same kind of report, so results stay comparable.
External assessment
Black-box testing from the internet, exactly the way an attacker sees your site or API.
- Any hostname you own — verified once, scanned as often as your plan allows
- Light or deep depth; included in the monthly plans
- Reconnaissance, injection, authentication, access control and misconfiguration classes
Source-aware assessment
White-box testing: the engine reads your source, finds real attack paths and then proves them against the running application.
- GitHub or ZIP upload, sized automatically before you spend a single credit
- Choose the Standard or Maximum model tier per scan
- Optional agentic SAST and authenticated testing with your test accounts
From hostname to proof in minutes
Point DMZ at a target, choose a depth, and let it do the work — no scanners to tune, no agents to install.
Comparison
Why teams choose DMZ
Proof over possibilities — continuous, exploit-verified testing you can hand to clients and auditors.
| Capability | DMZ | Manual pentest | DIY scanners |
|---|---|---|---|
| Every finding proven with a working exploit | |||
| Continuous, on-demand testing | |||
| Source-aware (white-box) testing | |||
| Security score & grade, tracked over time | |||
| New / recurring / fixed diffing across scans | |||
| Shareable, verifiable summary report | |||
| Predictable, transparent pricing |
FAQ
Questions we get asked
Is it safe to run against production?
+
The engine is instructed to stay conservative and your rules of engagement keep it away from destructive paths, but every test generates real traffic. We recommend a staging environment for deep runs, and always having backups.
How is this different from a vulnerability scanner?
+
Scanners list possibilities. DMZ behaves like a penetration tester: it reasons about your application, chains steps together, and reports only what it could actually exploit — each finding with a reproducible proof.
Who can see my findings?
+
Only members of your account. The shareable summary deliberately contains no findings — just methods, coverage and score — and anyone holding it can verify its authenticity online.
What happens if a scan fails midway?
+
You are not charged. Failed source-aware runs can be resumed from where they stopped; completed work is re-used and you pay only once a report is produced.
Do I have to verify my domain?
+
Yes — once per domain, with a DNS TXT record or a small file on your site. It protects everyone from unauthorized testing.
What is a penetration test and why does my website need one?
+
A penetration test is a controlled attempt to break into your website or application exactly as an attacker would, to find vulnerabilities before someone else does. DMZ performs it with AI: it scans the site, actually tries to exploit what it finds, and reports only what it could prove — with a security score and a report you can hand to management or clients.
What's the difference between a website security scan and a penetration test?
+
A security scan (vulnerability scan) automatically looks for known weaknesses and produces a list of suspects you still have to triage. A penetration test goes further and tries to exploit them like a real attacker. DMZ combines both: a broad security scan of the site, proven exploitation of the findings, and two report levels — a full technical report and a shareable summary.
Know your exposure before someone else does.
Start with one verified asset for free, and add your source code when you're ready.