What is Agent-as-a-Service pentesting?

Agent-as-a-Service (AaaS) pentesting lets you chat with autonomous pentesting agents that scan your application on demand. Instead of waiting weeks for a manual engagement, you talk to specialized agents — pen-scout (recon and surface mapping), pen-recon (deeper enumeration), pen-triage (validates and prioritizes findings), pen-fixer (remediation guidance), and pen-compliance (OWASP/standards mapping). Findings are validated with proof-of-concept and re-test, not just flagged. You start with 150 free credits, no credit card.

What are credits and how do they work?

Credits are how you run agent scans. Each scan or agent action consumes credits based on its depth. New accounts get 150 free credits with no card required. After that you can buy one-time credit packs ($29, $79, or $199) for pay-as-you-go use, or subscribe to a monthly tier ($49, $149, or $399/mo) for continuous, on-demand pentesting. The agents pen-scout, pen-recon, pen-triage, pen-fixer and pen-compliance all draw from the same credit balance.

Yes. Every new account gets 150 free credits with no credit card required — enough to chat with the pentesting agents and run real scans against your app. There is also a free security headers scan at sable.somoswilab.com/free-scan and a sample report at sable.somoswilab.com/sample-report. The free tier runs on OpenRouter models so you can evaluate the autonomous agents before paying.

What is penetration testing for startups?

Penetration testing (pentesting) is a simulated cyberattack against your application to find security vulnerabilities before real attackers do. For startups, we focus on the issues that matter most at your stage: authentication flaws, data exposure, API security, and common mistakes in modern stacks like Next.js, Supabase, and Firebase.

How much does a pentest cost?

Traditional pentests cost $10,000-$50,000+. SableOffensive starts at $29 for a Pre-Launch Check covering OWASP Top 10 and secrets detection. Founder Shield ($79) adds IDOR testing, auth bypass, and a debrief call. Scale Secure ($199) is a full-scope assessment. Every plan includes a professional report with remediation steps.

How long does a security scan take?

Pre-Launch Check reports are delivered within 24-48 hours. Founder Shield and Scale Secure may take 2-3 business days depending on the complexity of your application.

What do I need to provide?

At minimum, just your application URL. For more comprehensive testing, we may ask for staging credentials, API documentation, or GitHub repository access. We sign NDAs for all engagements.

What is OWASP Top 10?

OWASP Top 10 is the industry standard list of the most critical web application security risks. It includes injection attacks, broken authentication, cross-site scripting (XSS), server-side request forgery (SSRF), and security misconfigurations. Every SableOffensive assessment tests against the full OWASP Top 10.

Do you test AI-generated code?

Yes. Code generated by AI tools like Cursor, GitHub Copilot, and v0 often contains subtle security issues: hardcoded secrets, missing input validation, insecure API patterns, and overly permissive access controls. We have specific testing procedures for AI-generated codebases.

How do you secure Supabase and Firebase apps?

For Supabase, we audit Row Level Security (RLS) policies, test for direct table access, and check for exposed service keys. For Firebase, we review security rules, test Firestore/RTDB access patterns, and check Cloud Functions for vulnerabilities.

What if you find zero vulnerabilities?

50% money back guarantee. If our scan finds zero security issues, you get half your money back.

Is there a free pentesting option?

Yes. SableOffensive offers a free security headers scan at sable.somoswilab.com/free-scan. It instantly checks your website for 8 critical security headers (HSTS, CSP, X-Frame-Options, and more) and gives you an A-F grade with copy-paste fixes. No signup or payment required.

Can I get a free vulnerability scan?

Our free security headers check scans your website instantly and grades your security posture. For a deeper free assessment, contact us — we occasionally offer complimentary scans for early-stage startups and open source projects.

Microsoft Patches 138 Vulnerabilities: Netlogon and DNS RCE Flaws Lead May Update

What Happened

Microsoft released its May 2026 Patch Tuesday security update on May 12, patching 138 vulnerabilities across the Windows ecosystem — including 17 rated critical. Two flaws stand out for their potential to compromise enterprise networks at scale: CVE-2026-41089, a remote code execution vulnerability in Windows Netlogon carrying a CVSS score of 9.8, and CVE-2026-41096, a critical RCE in the Windows DNS Client, also rated CVSS 9.8. The Hacker News confirmed no zero-days were disclosed in this batch, but the severity of the top-line flaws makes this one of the most consequential Patch Tuesdays of 2026 so far. CyberSecurityNews noted that the Netlogon and DNS Client flaws echo the impact category of historical bugs like SigRed and Zerologon.

Technical Analysis

CVE-2026-41089: Windows Netlogon RCE (CVSS 9.8)

The Netlogon vulnerability allows an unauthenticated attacker to execute remote code with SYSTEM privileges on affected domain controllers — no user interaction required. Netlogon (MS-NRPC) is the protocol that handles authentication between Windows machines and domain controllers. A successful exploit gives the attacker full control over the domain controller, which in turn means full control over the entire Active Directory forest. Vulert's analysis rates this as the most urgent fix in the May batch. Rapid7 confirmed the attack vector targets the Netlogon RPC interface, and exploitation could allow low-privileged or unauthenticated attackers to escalate to SYSTEM on domain controllers — the same trust boundary that Zerologon (CVE-2020-1472) exploited in 2020.

CVE-2026-41096: Windows DNS Client RCE (CVSS 9.8)

The DNS Client flaw is a remote code execution vulnerability in the Windows DNS client implementation. Because DNS is a core networking service running on virtually every Windows system in an enterprise, exploitation could cascade rapidly across the environment. Infosecurity Magazine quoted Action1 vulnerability research director Jack Bicer: "Because DNS is a core networking service used across enterprise environments, exploitation could impact a large number of systems rapidly." The flaw carries a CVSS 9.8 rating, placing it in the same severity tier as the notorious SigRed (CVE-2020-1350) DNS vulnerability.

The Full Scope

Beyond the two headline RCEs, the May batch includes:

17 critical vulnerabilities total, including flaws in Azure DevOps and Dynamics 365
4 Word RCE vulnerabilities that could be exploited via malicious documents
Multiple privilege escalation and information disclosure flaws across Windows components
Notably, Microsoft's own MDASH AI system discovered and helped fix 16 of the Windows flaws in this batch — a sign that AI-assisted vulnerability discovery is becoming operationally relevant

Who's Affected

Every organization running Windows domain controllers — CVE-2026-41089 puts Active Directory at risk. If you run AD, your domain controllers are the primary target.
Any Windows system running the DNS client — CVE-2026-41096 affects workstations and servers alike. DNS is not optional.
Azure DevOps and Dynamics 365 customers — critical flaws in these services could expose cloud-hosted development pipelines and business applications.
Organizations that delay patching — historical data shows that Patch Tuesday exploits typically appear in the wild within 30 days of disclosure. The Netlogon and DNS flaws will likely be weaponized faster.

How to Protect Yourself

Patch domain controllers first. CVE-2026-41089 is the highest-priority fix. If you can only patch one thing today, make it your domain controllers. This is a Zerologon-class flaw — treat it accordingly.
Apply the DNS Client patch (CVE-2026-41096) to all Windows systems within 48 hours. DNS is everywhere. Don't just patch servers — workstations running the DNS client are also in scope.
Audit Netlogon RPC exposure. Ensure that Netlogon RPC ports (TCP 135, dynamic RPC ports) are not directly accessible from untrusted networks. Use firewall rules to restrict access to domain controllers.
Enable Netlogon secure channel signing. If you haven't already enforced secure channel signing for Netlogon (per Microsoft's 2021 guidance after Zerologon), do it now. It adds defense-in-depth even after patching.
Verify Azure DevOps and Dynamics 365 patches. If you run these services, confirm that the critical CVEs specific to them are applied — cloud service patches sometimes require tenant-level action, not just Microsoft-side fixes.

The Sable Angle

May's Patch Tuesday is a reminder that the most dangerous vulnerabilities aren't always zero-days — they're the critical, network-facing RCEs that sit unpatched on domain controllers for weeks because patching is "disruptive." At Sable, we see this constantly in red team engagements: organizations with mature endpoint detection but stale domain controller patching. A single unpatched Netlogon flaw is a full-domain compromise in under 30 minutes. Our offensive assessments map exactly these trust boundaries — Active Directory attack paths, DNS poisoning surfaces, and the gap between your patch policy and your actual patch reality. If your last AD security assessment was more than 6 months ago, it's time.