AI pentesting for startups: when it fits and what to prepare

AI pentesting fits a startup that has a web app or API and needs proof of its security state at a set time. Two common moments are a customer security review and a pre-launch check. It does not fit if you need a test of people, offices or a network.

When does AI pentesting fit a startup?#

It fits when you have a defined target, a deadline for evidence, and a small team. AI-assisted testing by Excession Labs covers web applications and APIs. Incursion does the testing work under tool rules. Excession Labs agrees scope with you in writing, checks the evidence for each finding and writes the report.

Typical triggers:

• A customer security review: An enterprise buyer asks for a pentest report or a summary. For the buyer's view of what to expect, see pentest reports for customer security reviews.
• A pre-launch check: You want to find broken access control before real users arrive.
• A major release: You added roles, billing or an API. See pentesting in CI/CD.
• A fix check: You fixed earlier findings and want proof.

If you have not launched, a free pilot may suit you. Read the pilot page for terms.

What should you prepare?#

Use this readiness list for a first test.

The production safety guide covers the safety rows in detail.

What will you get?#

You get a written report with proof. Each finding includes the evidence, the steps to reproduce it, and a suggested fix. The report also lists controls that held, and a section on limitations and open questions.

Formats are HTML, PDF and Markdown, plus proof-of-concept scripts. Severity uses a four-level scale: Critical, High, Medium and Low, each with a written definition. CVSS vectors are not added by default. Tell us during scoping if a customer asks for CVSS.

We can retest fixed findings. We do not state here whether a retest is free or how long it takes. Agree this in the written scope.

What will it not give you?#

Know these limits before you plan around a test:

• Compliance: A pentest report is evidence. It does not make you compliant. Standards set their own text. For example, OWASP ASVS says Level 1 is a starting point, not a finish line. Ask your auditor or customer what they accept.
• A clean bill of health: A test with no findings means nothing was found in that scope. It says nothing more about the rest of the system.
• All vulnerabilities: Incursion does not find all of them. No test does.
• People and places: Phishing, phone pretexts and physical access are out of scope.
• Business-rule judgment: You must tell us your rules. Where AI pentesting falls short gives the full list.
• A fixed price or date on this page: Prices are quoted after scoping. We publish no turnaround times.

How do you choose between a pilot, a one-off test and recurring testing?#

Pick by the question you need answered.

Paid work is priced after scoping. The pricing page lists what changes a quote. We do not publish prices.

Whichever you choose, the process starts with a short call to understand the need, then a written scope and proposal. We test only with written authorization from the system owner, so settle the authorization items on the checklist early.

How should a small team handle the findings?#

Handle findings in order of impact. Fix High and Critical items first. Create one ticket per finding and attach the evidence. Ask for a retest after the fix. Then add a regression test to your own CI so the bug does not return.

The OWASP Web Security Testing Guide lists test areas your team can cover in its own checks. Keep the "controls that held" list. It tells you what to protect when you refactor.

If a customer asks for your report, share what your contract allows. Do not share raw evidence that includes secrets. Ask your lawyer before you share a full report outside the company.

To scope a test, open the pilot page or read how it works.