Breaching a company like yours now costs an attacker about $50.
One attacker pointed AI agents at more than 1,200 sites and got into about 100 of them. We test your systems the same way before someone else does, and you pay only if we find a real weakness.
We never test a system without written authorisation from its owner.
Today's attacker is software that never sleeps.
Breaching a company used to take a team and time. Now it takes a short instruction to an AI agent that tries more than a thousand sites, one after another.
- Under 100 characters
The length of the instructions the attacker gave the agents in the 100-breach campaign.
- 5 days
How long three AI agents took to hit about two dozen companies and take more than 600,000 card numbers.
Attackers no longer pick their victims. They try everyone and walk in through the open door.
And the open door is usually something basic.
In this year's incidents where the cause was published, it was a mistake an ordinary test would catch.
An admin panel exposed to the internet with an easy password
This is reportedly how attackers reached supermarket fridges in France.
A vendor weaker than you
French blood banks were hit through a third-party component, according to the supplier.
A firewall or VPN gateway left unpatched
A common way in for ransomware in the Gulf.
Automated scanning of public web applications
Now driven by AI.
It is not only data anymore.
This year's attacks spoiled stock and threatened a blood supply.
French supermarket fridges
Attackers forced a defrost cycle overnight in up to about 700 stores. No alarms fired.
Tens of millions of euros, by press estimates
French blood banks
Attackers took control of cold storage at three sites and tried to raise the temperature. Monitoring and staff saved it.
A near miss
And in Saudi Arabia: five organisations claimed in six weeks.
Between 1 October and 12 November 2026, ransomware groups listed five Saudi organisations on their leak sites. These are the attackers' own claims, and the organisations have not confirmed them.
- 1 OctoberNodhom
A cloud ERP provider holding its customers' operating data.
- 3 OctoberJeddah Central Stadium contractor
More than 1.5 million files and the data of about 150,000 employees.
- 7 OctoberRaqib
A cybersecurity company.
- 3 NovemberCentrepoint
3,094,863 loyalty customer records.
- 12 NovemberUnited Pharmacy
A pharmacy chain with more than 450 branches.
The bill lands on the board's table.
When a breach happens, the cost is a quarter's revenue, customer trust and regulatory exposure.
- €200–250M
Sales Ahold Delhaize lost in one quarter after one attack.
- $8M
Average cost of a data breach in the Middle East.
- SAR 5M
The maximum fine per violation under the Saudi Personal Data Protection Law.
We have reported security weaknesses to companies of this size.
Companies our team has filed security reports with, through their official bug bounty programs and under each program's rules.
How it works, in four steps.
It starts with a 30-minute call, and no testing begins before you sign.
Agreement
One agreement gives us written permission to test. Electronic signature is accepted.
Test
We test your digital presence from the outside, continuously, the way an attacker would, with AI models we build and run on our own infrastructure. We need no passwords, no accounts and none of your team's time.
Report
We report every weakness quickly, and critical ones at once, with the proof, the impact and how to fix it. You pay half the reward here.
Fix
We help you fix it free of charge, then retest to make sure. You pay the other half once the fix is confirmed.
Why pay on results?
Because you are buying proven weaknesses, not hours.
- No setup fee, no subscription and no minimum.
- You pay only for a valid weakness backed by evidence.
- Half the reward on proof, the other half after the fix.
- We help you fix every weakness free of charge.
Reward by severity
- Full compromiseFull control of your systems or your database.
- CriticalRunning commands on a server remotely.
- HighAccount takeover, or access to the admin panel or to many users' data.
- MediumAccess to another user's data on a limited scale.
- LowA weakness with limited impact.
The reward for each level is written in the agreement before we start. If we disagree on a level, a recognised international standard decides.
What we test, and what we never touch.
The scope and the rules are written in the agreement, and we stay inside them.
We test
- Websites, web applications and APIs.
- Exposed login pages and admin panels.
- Servers, cloud storage and devices connected to the internet.
- And what we discover that you did not know was exposed.
We never
- Disrupt your service or run denial-of-service attacks.
- Delete, change or encrypt your data.
- Target your staff with phishing or social engineering.
- Sell your weaknesses or name you without your consent.
Questions asked before signing
Is this legal?
Yes. The signed agreement is the written permission Saudi law requires, and it sets the testing rules and each side's responsibility.
What if something breaks during testing?
Our testing never includes denial-of-service attacks, and we prove each weakness with the minimum safe evidence, without deleting, changing or disabling anything.
What do we pay, and when?
Nothing upfront. You pay half the reward when you receive the evidence-backed report, and the other half after we retest and confirm the fix. If we find nothing, you pay nothing.
Can one weakness be counted more than once?
No. One root cause is counted once, and a chain of linked weaknesses is counted once at its highest level.
Who sees the weaknesses?
Only you. Everything is confidential during the agreement and after it. Once a weakness is fixed we may publish a technical write-up for awareness, with no confidential data and without your name unless you agree.
What are we committing to?
An ongoing agreement you can end at any time with written notice.
See what an attacker sees in your systems, before they use it.
A 30-minute call, then one agreement you sign electronically, then we begin.
Sources
Figures last reviewed on 13 November 2026.
- Reuters, 19 October 2026 (via Fortune): the 100-breach AI agent campaign.
- BleepingComputer: three chained AI agents, September 2026.
- Wikipedia citing Reuters (12 October 2026), and PA Global (11 November 2026): European supermarket fridges.
- The Guardian, 4 November 2026: French blood banks.
- DutchNews, November 2026: Ahold Delhaize.
- The National (6 October and 11 November 2026), with ransomware.live, DeXpose and Hackmanac: the Saudi cases.
- IBM, Cost of a Data Breach 2026, via PA Global.