Question 1

Is PentestBR just an AI vulnerability scanner?

Accepted Answer

No. Scanners usually apply known checks and report suspicious behavior. PentestBR forms hypotheses, interacts with the application, adapts its strategy from the responses, tries to chain attack paths and validates findings through reproducible exploitation.

Question 2

Does PentestBR really exploit vulnerabilities?

Accepted Answer

Yes, within the scope and policies explicitly authorized by the system owner. The goal of exploitation is to prove impact in a controlled way.

Question 3

Can I test production?

Accepted Answer

PentestBR has scope, intensity and safety controls for each environment. Sensitive environments can use more restrictive policies, and tests with destructive effect or higher risk require appropriate authorization.

Question 4

Do I need to provide my code?

Accepted Answer

No. Black box works without source code. Extra accounts, an OpenAPI spec and documentation (grey box) increase the context and depth of the test. With the source code (white box), the agents understand rules and trust boundaries and focus the tests on what can be proven.

Question 5

Does PentestBR replace human pentesters?

Accepted Answer

The goal is to automate a large share of repeatable, continuous offensive testing. Highly contextual engagements, physical targets, social engineering and certain complex scenarios can still call for human specialists.

Question 6

How do you avoid false positives?

Accepted Answer

Confirmed findings must present exploitation evidence and pass independent validation. Anything that cannot be proven is kept separate from the confirmed vulnerabilities.

Question 7

Is there a retest?

Accepted Answer

Yes. After a fix, Verify Fix retests the finding right from the dashboard, without requiring a new manual engagement.

Question 8

Can I connect it to CI/CD?

Accepted Answer

Coming soon. The repository integration will identify which parts of the attack surface each change affected and test only what changed, before it reaches production.

Question 9

How much does it cost?

Accepted Answer

Plans start at R$ 690/mo (Essential). Professional is R$ 1,990/mo and One-off is R$ 4,990 per target (prices in Brazilian reais). The initial mapping shows the surface and recommended scope before any active pentest.

Question 10

Does the report work for SOC 2 and ISO 27001?

Accepted Answer

Yes. The audit report carries scope, methodology, findings, severity, reproduction evidence and remediation guidance. The methodology follows OWASP, PTES and NIST.

Question 11

Does it help with GDPR / LGPD?

Accepted Answer

Yes. Data-protection law requires security measures proportional to the risks, and a documented test with evidence is the most direct way to demonstrate that diligence.