How it works
A security review tests your website or app the way an attacker would, proves every problem it reports, and tells you how to fix it, in words your developer and your boss can both follow.
Four steps
- 1Book a reviewTell us which site and what's coming up. Harry replies within 1 working day.
- 2Prove the site is yoursAdd one small file or DNS record. About 10 minutes, and we send the exact steps.
- 3We test, a person checksRyvx tests like an attacker. Every finding needs working proof, and Harry reads every report.
- 4Report, call, retestA summary for the boss, detail for the developer, a 20-minute call and one retest after you fix.
The engine, in plain words
Ryvx maps your site, looks for weak spots, and tries them the way a real attacker would: signing in as one customer and reaching for another's data, sending crafted input to forms and search boxes, checking what is left open.
A problem only makes the report once Ryvx has shown it works, with the exact steps. Anything it cannot prove is dropped, so you are not left sorting through maybes.
Software does the heavy lifting. Harry reads every report before you get it, and walks you through it on a call.
Nothing is tested until you prove the site is yours and sign off in writing. Anything that could change data stays off unless you switch it on.
Want to see the result? Read the sample report.
8 of 8 on OWASP Juice Shop.
Graded by the target's own scoreboard, not by reading our report. We withdrew our previous numbers in August because the runs behind them had been cut short and the write-up was done by hand. These come from untruncated runs, scored by the harness, with the run count and the exclusions stated.
reproduced the full sweep three and a half weeks later on the same engine; $0.38 in tokens, 17 findings filed alongside
every challenge solved, including Repetitive Registration, which had never been solved in any prior run
DOM XSS and Forged Review both solved; only Repetitive Registration missed
ended early by hand to free the queue; a killed scan writes no harness score
47 connection failures in 219 events; it measured a dead container, not the engine
Model: the Ryvx internal engine, the same one hosted scans run on. The score on a frontier model is unmeasured, not assumed, and on this corpus we have no reason to expect it would be higher: a run on a model roughly fifteen times more expensive per token scored lower on the same eight challenges the same night. On 2026-09-28 two further models, one at our own price point and one below it, were run on the same eight challenges and scored 1 of 8 each: the recall tracks the engine and its tooling, not the price per token.
The 8 of 8 has now scored twice, on 2026-09-02 and again on 2026-09-28, three and a half weeks apart on the same engine, at $0.37 and $0.38 in tokens. Two scored runs is still not a rate, so we quote them as measurements and not as "we score 8/8"; we will replace them with an averaged figure once we have several consecutive runs. Repetitive Registration, unsolved in every run before 2026-09-02, was solved in both.
On a separate Juice Shop run, Ryvx filed 19 findings the evidence gate accepted and rejected 10 for incomplete evidence. Several of those were completed and re-filed by the agent, which is the retry loop working. The CWE classification was correct on all 19, and the one proof-of-concept we executed by hand reproduced first try against the live target: 15 records, 6 users, no auth, exactly as the finding claimed.
What that is not: an independently verified precision figure. Ryvx did not run those PoCs itself. A person did. We are not going to quote a false-positive rate off a set we checked one member of. These numbers are also ours, on a public CTF target we triaged ourselves; treat them as our own measurement rather than an independent evaluation.
In the run we had been quoting, the coordinating agent finished while five subagents were still working. They were given sixty seconds and then canceled mid-request. One had just had a finding rejected over a formatting error and never got to re-file it. The score was real, but it measured an investigation that stopped early.
Agents now get as long as their own turn and cost budgets allow, every run records whether anything was cut off, and the harness refuses to score a run it detects as truncated or aimed at an unreachable target, which is why one run above is void rather than a 3 of 8. A tool that refuses to report an unproven finding should hold itself to the same rule.
Testing AI chatbots and agents
If your site or app has a chatbot or an AI agent, we test that too. You tell us what it must never do, for example show another customer's order or use a tool it should not. We send it real attacks and report what we tried, what got past those limits, and what we did not test.
The checks follow the OWASP Top 10 for AI applications. Two of the ten cannot be tested by talking to a chatbot, so the report says so rather than leaving a blank.
- LLM01Prompt injectionAttempts to override its instructions, directly and hidden in content it reads.Tested
- LLM02Sensitive information disclosureAttempts to get it to reveal data it should keep private, in one message or over a conversation.Tested
- LLM03Supply chainCannot be reached by talking to the chatbot: it needs the model and library history. A dependency scan covers known-vulnerable AI libraries instead.Not tested
- LLM04Data and model poisoningCannot be reached by talking to the chatbot: it needs access to the training data.Not tested
- LLM05Improper output handlingChecks whether its replies could carry something harmful into your site. Reported as a lead to look at, not a confirmed finding.Tested
- LLM06Excessive agencyAttempts to get it to use its tools or permissions beyond the limits you set.Tested
- LLM07System prompt leakageAttempts to get it to reveal its hidden instructions, confirmed only against a marker you plant.Tested
- LLM08Vector and embedding weaknessesAttempts to retrieve a document it should not reach, confirmed only against a marker you plant.Tested
- LLM09MisinformationPushes it to state something false as fact, checked only against a false statement you give us.Tested
- LLM10Unbounded consumptionMeasures whether one request can make it do far more work than it should.Tested
How Ryvx compares
| Question | A scanner | Ryvx | A consultancy pentest |
|---|---|---|---|
| What you get | A long list of possible issues to check yourself | Only problems shown to work, each with its proof, checked by a person | A signed report from a named tester |
| Price | A monthly subscription | £495 per site, fixed | Usually thousands per engagement |
| Time to a report | Minutes | 3 to 5 working days | Often weeks to book and run |
| Testing that could change data | Usually off, or a paid extra | Off unless you switch it on | Agreed in scope and supervised by a person |
| Creative judgment | None: one rule, one match | Limited: the software follows set roles, and a person reviews the result | Yes: it is what you are paying for |
| If something is missed | No one is accountable | A full record of what was tested; Ryvx is not a certification body | The firm's professional standing and liability |
There is no published, audited figure comparing Ryvx's find rate with any scanner's, and none appears here. What you can check is the sample report and the verification details.
What Ryvx is not
- Not a certificate that your site is secure. No test can prove that.
- Not CREST accredited and not a PCI Approved Scanning Vendor.
- Not a replacement for a full manual penetration test where a contract or regulator requires one.
- Never pointed at a site without the owner's written permission.
- Not something we dress up: no customer logos or testimonials until there are real ones to show.