Simple, transparent pricing
One test, or a volume pack at a lower price per test. No subscription: your credits are valid for 12 months.
1 test
Check one application before a release.
100 €/test
1 test
Valid 12 months from purchase
5-test pack
One test per release, over a few months.
90 €/test −10 %
5 tests
Valid 12 months from purchase
10-test pack
Several apps, or a steady release cadence.
80 €/test −20 %
10 tests
Valid 12 months from purchase
25-test pack
Continuous deployment across several apps.
70 €/test −30 %
25 tests
Valid 12 months from purchase
Included in every test
- ✔ Automated non-destructive test
- ✔ No exploitation
- ✔ No changes to your data
- ✔ External black-box test
- ✔ No access to your code
- ✔ Site crawl across multiple depth levels
- ✔ TLS/SSL analysis
- ✔ Protocol analysis
- ✔ Cipher analysis
- ✔ Certificate analysis
- ✔ HSTS analysis
- ✔ Misconfiguration detection
- ✔ Exposed file detection
- ✔ XSS injection detection
- ✔ Error-based SQLi injection detection
- ✔ Local file read injection detection
- ✔ CORS policy check
- ✔ Vulnerable JavaScript libraries
- ✔ Secrets exposed in public code (keys, tokens)
- ✔ Domain email configuration (SPF, DMARC, CAA)
- ✔ Detailed report
- ✔ PDF report export
- ✔ Results history
One-time payment, no subscription or automatic renewal. Credits are valid for 12 months and non-refundable. Need more than 25 tests? Email us: contact@cyberdur.com
Frequently asked questions
What is CYBERDUR? +
Cyberdur is the French specialist in non-destructive automated penetration testing. You give us the address of a web application (after proving you control the domain) and our engine probes it from the outside, without touching your data: TLS configuration, misconfigurations and exposed files, common injections (XSS, SQL injection, local file read), CORS policy, vulnerable JavaScript libraries, exposed secrets and your domain's email setup. You then receive a report with every finding detected.
Is it safe to run on production? +
Yes. The test is non-destructive: no exploitation, and none of your data is changed or deleted. It does send traffic to your site (page requests and harmless probes).
How long does a test take? +
The test starts automatically once your domain is verified. Tests take several hours and typically finish within 3 hours, but may take longer depending on the size of the site. You get an email the moment your report is ready.
What is in the report? +
A short summary, an overall severity rating, and every finding grouped by severity: Critical, High, Medium, Low. Each one has a description and the command or hint to verify it. Purely informational findings are listed separately, in an Informations section. Reports are exportable as PDF. Your previous test report history remains available in your personal dashboard.
Why is this so much cheaper than a manual pentest? +
The repetitive mapping and testing work is fully automated. We sell a single test or a pack, not consultant day-rates.
How long are my credits valid, and are they refundable? +
Every test you buy, single or in a pack, is valid for 12 months from the purchase date and then expires. Credits are non-refundable and non-transferable. A request cancelled before the test starts, or never verified within 30 days, is returned: the credit goes back to your account.