AI helps small teams ship in days. It also helps attackers find what slipped through. We test your product by hand, using methods real attackers use, within an agreed scope, and tell you in plain language what to fix first.
First test from €4,500 fixed · 3 tester days · From Germany
$ subfinder -d example.com -silent
www.example.com
api.example.com
staging.example.com # forgotten test server
$ curl -sI staging.example.com/invoices/1042
HTTP/2 200 # no login required
$ curl -s staging.example.com/invoices/1042 | jq .total
"€18,400.00" # real customer data~/why-now
You probably adopted AI to move faster. So did the people trying to break in. The result is more code, less review and faster attacks, and it lands hardest on teams with nobody watching.
45%
Across 100+ AI models, 45% of test cases introduced an OWASP Top 10 flaw. Newer models wrote more correct code, but no safer code.
Veracode GenAI Code Security Report, 2025 ↗29 min
The average time criminals needed to move on from the first system they broke into in 2025. AI-enabled attacker operations rose 89% in a year.
CrowdStrike Global Threat Report, 2026 ↗31%
Exploiting vulnerabilities is now the most common way in, ahead of stolen passwords. Your code is the front door.
Verizon Data Breach Investigations Report, 2026 ↗It is no longer just elite hackers. In a campaign disclosed in 2025, attackers used AI to perform 80 to 90% of the work against roughly 30 targets. The investigators' warning: less experienced groups can now potentially run attacks like this. Anthropic, 2025 ↗
Being small does not protect you. Automated attacks scan whatever is reachable on the internet. They do not check your headcount first, and a startup with customer data and no security team is an easy place to start.
~/your-code
AI writes code that passes the demo and the tests. It does what you asked for, not what you forgot to ask for. A quarter of Y Combinator's Winter 2025 batch reported codebases that were 95% AI-generated ↗, and a small team rarely has a senior security reviewer checking all of it.
const stripe = new Stripe("sk_live_••••••••");
app.get("/api/invoices/:id", async (req, res) => {
const invoice = await db.invoice.findUnique({
where: { id: req.params.id },
});
res.json(invoice);
});Illustrative example, not client code.
~/self-check
Six quick questions, and you get a rough picture of your exposure and where we would start.
Your answers stay in this browser. Nothing is sent or stored.
Is most of your code written or heavily assisted by AI tools?
Do you store customer, payment or health data?
Has anyone outside your company ever tested your product?
Could API keys or passwords be sitting in chat, tickets or old commits?
Does someone on your team own security as their main job?
Is a customer, investor or auditor asking for proof of security?
A rough guide based on your answers, not a security assessment.
This self-check needs JavaScript. Book a call with us directly.
~/when
~/services
Each option answers one business question. The difference is how much access we begin with. Most small teams start with one and add another later.
$ assess --scope one-app --access public
Starting point Path we test What attackers want
“What can a tester find in our app in three days?“
A focused manual test for early-stage companies that need a first outside check before customers or investors ask for one.
“What can an outsider reach and break into?“
We start with nothing but your company name and test what we can find and exploit from the public internet.
“How far can a compromised employee or contractor account get?“
We get the access a new employee would have on day one, then show how far that account could get if it were compromised or misused.
“What weaknesses inside the system could cause damage?“
With read access to your code, cloud and pipelines, we look for weaknesses that could lead to a breach, data loss or outage, including ones an outside test would never reach.
~/why-us
Automated tools catch a lot, cheaply, on every commit. They are generally weaker at business logic, such as whether customer A can read customer B's invoices. That is where a person testing your product adds value.
| Capability | Automated scanner or AI review | Our manual testing |
|---|---|---|
| Runs automatically on every code change | Yes | No |
| Looks for flaws in your business logic | Depends on the tool | Yes |
| A person confirms what can really be exploited | Depends on the tool | Yes |
| Explains impact for founders as well as engineers | Varies | Yes |
General patterns. Individual tools differ, and they work well together.
~/reports
Testing is manual, supported by tools. Every finding is verified by hand, rated with CVSS and adjusted for its impact on your business, so one report works for both your engineers and your management.
TLS 1.0 on legacy hostnot reachable, droppedX-Powered-By header exposedno real impact, droppedPossible SQLi on /searchfalse positive, droppedOutdated library on /blogno exploit path, droppedWeak cache headers on /assetsno real impact, droppedGET /api/invoices/:id → 200exploited, confirmedAnyone who finds this server can download customer invoices. You would likely face a GDPR notification and difficult conversations with customers.
Decision: fix before the next release.
The staging API has no authentication and object IDs are sequential. Proof of exploitation is attached.
Fix: enforce auth and per-object authorization. Remove production data from staging.
~/process
Eight steps, in writing, with nothing left vague. Testing usually starts 2 to 4 weeks after signing and receipt of the deposit.
We agree on the systems, applications and goals, and pick the package.
A fixed scope, timeline and price, signed by both sides, plus a data processing agreement.
Your managing director confirms in writing that you own or control every system in scope.
Testing windows, out-of-scope systems, our declared source IPs and a named emergency contact.
Critical findings are reported to you immediately, not held for the final report.
Delivered through an encrypted channel within 10 working days, then walked through with your team.
Within 90 days we verify your fixes and issue an updated report and a confirmation letter.
Client data and credentials are permanently deleted, and you receive a signed deletion certificate.
~/principles
You are handing a stranger the keys. Here is exactly what you can expect in return.
our_role = statedreport_style = attacker_viewdestructive_tests = nevertester_identity = privateclient_names = never_publisheddata_retention = minimal~/who
We keep our testers and our clients anonymous. The company and the person responsible for the work are not.
Soheil Nikbin
Founder and managing director, RiveDrive UG (haftungsbeschränkt)
Soheil has worked in security in high-security industries, including banking and manufacturing, running security checks and supporting many successful audits, including SOC 2 and ISO/IEC 27001 implementations. Soheil is responsible for every engagement we take on.
$ whoami
soheil.nikbin # Founder and managing director
$ cat ~/background
banking · manufacturing · high-security environments
SOC 2 and ISO/IEC 27001 implementation
security checks and audit support
$ ls ~/clients
ls: cannot open directory: Permission denied
# we never name clients~/compliance
We prepare you for a formal SOC 2 or ISO 27001:2022 audit. Our reports may be usable as penetration test evidence, so check with your auditor.
We do not perform the audit or issue the report or certificate. That stays with the auditor or certification body of your choice, and we cannot guarantee the result. Auditor fees and compliance platform licenses are not included.
How SOC 2 and ISO 27001 work with penetration testing →Typically 6 to 12 weeks · From €18,000
~/pricing
Every engagement has a fixed price, agreed in the proposal. These are starting prices for the smallest typical scope. The final price depends on the number of applications, APIs, user roles and environments.
| Package | Question it answers | Duration | Net price |
|---|---|---|---|
| Starter Test | What can a tester find in three days? | 3 tester days | Fixed €4,500 |
| External Assessment | What can an outsider break into? | 2 to 3 weeks | From €7,500 |
| Insider Assessment | How far can a compromised account get? | 2 to 3 weeks | From €8,000 |
| Full Access Review | What inside the system could cause damage? | 3 to 5 weeks | From €12,000 |
| Compliance Readiness | Ready for a SOC 2 or ISO 27001 audit? | 6 to 12 weeks | From €18,000 |
All engagements are governed by our legal terms.
~/faq
Most attackers do not choose by company size. They scan the internet for weaknesses and go after whatever they can reach, and AI tools make that cheaper. A small company with customer data and no one watching can be an easy target.
Yes. We test the running product and, in the Full Access Review, read the code itself. It makes no difference to us who or what wrote it. We look for what can be demonstrated in practice.
Keep doing both, because they catch a lot cheaply. They are weaker at business logic, such as whether customer A can read customer B's invoices, and they often do not confirm what can be exploited. A tester can show it within the agreed scope.
We never run denial-of-service, load or destructive tests, and we stop immediately if a system becomes unstable. Active testing always carries some risk, which is why we agree testing windows and confirm backups first.
They answer different questions. SOC 2 and ISO 27001 look at whether your controls and processes are defined and working. A penetration test looks at what testers can exploit in your product within an agreed scope. Whether you need one depends on your risks and on what your customers and auditor expect.
Yes, under confidentiality. A report may be usable as penetration test evidence for SOC 2 and ISO 27001 audits, so check with your auditor.
Yes. Every package includes a confirmation letter that confirms the scope and testing period, with no vulnerability details. You can share it freely.
Yes, a sample report from a fictional test is available on request.
Vetted security testers based in Germany, employed by RiveDrive. Their identities stay confidential, for their security and yours.
Because our clients trust us with their weaknesses. We never publish who we work for, and we will not publish your name either.
Some providers require notice before testing. You are responsible for checking their policies; during scoping we point out which providers are likely affected.
Credentials are removed after each testing phase, and all other data is deleted after the retest, with a signed deletion certificate. We keep only minimal testing logs and the business records the law requires.
Yes. Calls, project communication and reports can be in English or German, as agreed in the proposal.
$ ./start --scoping-call
Tell us what you run and what worries you. We will agree on the scope together and send you a fixed-price proposal. Testing usually starts 2 to 4 weeks after signing.
or email crew@rivedrive.com