Find it before
they do.
We run authorized penetration testing the way we'd want ours run: automated recon and active testing, scoped to exactly what you signed off on, logged so nothing gets lost, and never a step further without a human approving the exact exploit attempt first.
14-day free trial, recon-only, up to 10 targets/month, no card required. Want to talk through an engagement instead? Write to [email protected].
GDPR compliant
Penetration Testing Services
Full-scope penetration testing services, all scoped to your ROE and none of it exploited without sign-off.
01Web applications
Injection (SQLi, SSTI, XXE, OS command injection), XSS, IDOR, path traversal, SSRF, CSRF, race conditions, unrestricted file upload, default credentials, auth and session flaws, exposed secrets in client-side JS, and the rest of the OWASP Top 10 - not just a signature match.
Learn more →02APIs
Injection, authorization checks between endpoints, and GraphQL introspection exposure - the same active testing we run against web applications, applied to REST and GraphQL APIs.
Learn more →03Networks & infrastructure
Port and service enumeration, exposed admin panels and files, subdomain takeover, exposed container/orchestration APIs (Docker, Kubernetes, etcd), public cloud storage exposure, WAF/CDN fingerprinting, and configuration weaknesses across the stack.
Learn more →04Email & domain posture
SPF, DKIM, and DMARC configuration, plus breach-exposure lookups for common role mailboxes - the gaps that let someone spoof your own domain back at you or credential-stuff their way in.
Learn more →05Compliance-aligned reporting
Findings mapped to the OWASP Top 10, PCI-DSS, GDPR, and SOC 2 controls, with a standard CVSS v3.1 base score per finding, so the report speaks the language your auditor already uses.
Learn more →06Workflow & delivery
One-click tickets into Jira, Linear, or GitHub Issues, a no-login client status link for progress updates, scans that run on a recurring schedule, and SSO for your team - the parts that make this a fit into how you already work, not a separate silo.
Learn more →How it works
Slower by design in exactly the places that matter - not a scanner that goes looking for trouble on its own.
Define scope
Targets and access level are locked into a Rules of Engagement before anything runs. Nothing outside it gets touched.
Automated testing
Recon and every active-testing scanner run within scope - XSS, SSTI, SSRF, IDOR, secrets, and the rest.
Chain correlation
Findings are checked against 56 known attack-chain patterns - not a flat list, a picture of what an attacker would actually do next.
Human-approved exploitation
SQL injection and Metasploit modules wait for a person to approve the exact action first, then a scored, compliance-mapped report ships.
Why "Siege"?
Because that's closer to what a real test looks like than "scan" ever was - patient, methodical, and only escalating when the last step earned it. Not a tool that goes looking for trouble on its own.
We built it after getting tired of choosing between pentest tooling that moved too fast to trust and audit trails too thin to hand to a client afterward. So it's slower by design in exactly the places that matter, and it keeps the receipts.
Siege is built by the team behind Shieldome, a vulnerability scanner that gives developers a full OWASP Top 10 report in minutes, with plain-English fixes for their own stack. Shieldome tells you what might be wrong. Siege proves what's actually exploitable, the step an automated scan can't responsibly take on its own. Together they cover the full VAPT (vulnerability assessment and penetration testing) cycle that PCI DSS and SOC 2 auditors actually ask for.
- The Shieldome team
What a finding looks like
Scored, chained, and traceable - here's an example, not a live scan.
Pricing
Three plans, priced up front - no per-engagement quote games. 14-day free trial, no card required. Annual billing saves 15% on any plan. See how this compares to typical penetration testing costs.
Up to 10 targets/month, unlimited rescans. The full detection suite - passive recon, nmap, Nuclei, and every active tester (XSS, IDOR, SSTI, SSRF, command injection, SQL injection identification, and the rest) - plus CVSS vectors, PDF reports, API access, scheduled scans, ticket integrations, and SSO. Everything except exploit confirmation.
Start 14-Day TrialUp to 10 targets/month. Everything in Core, plus SQL injection and Metasploit exploit confirmation and retest after remediation - always human-approval-gated. Exploit confirmation is in early access; we recommend independently verifying Critical/High findings while it matures.
Talk to Sales50 targets/month included, then $20 per additional target. Everything in Pro, plus white-label reports - built for agencies running several client engagements at once.
Talk to SalesNeed more than 100 targets a month, or a custom arrangement? Email us at [email protected] or sign in to request a plan.
Run it under your own brand
Reselling security work to your own clients? White-label every report - the word "Shieldome" never appears.
- →Upload your logo and pick your brand color once, per organization.
- →Every PDF report ships with your header, your footer, your name - not a co-brand.
- →Included with the Agency plan.
Penetration testing FAQ
What is authorized penetration testing?
How is this different from a vulnerability scanner?
Is this manual or automated penetration testing?
How much does a penetration test cost?
What counts as one target?
Do you support black box, white box, and gray box testing?
How often should we run a penetration test?
Could this damage or take down our systems?
Ready to find it first?
14 days, recon-only, up to 10 targets, no card required.
Tell us about the engagement
Scope, timeline, whatever you've got - we'll follow up from there.