We attack your web applications, APIs and AI agents the way a real attacker would, prove each weakness we find, help you fix it and test again. The testing runs on Decima Systems, the AI-driven validation service Lennart Lopin (CISSP, CCSP, CSSLP) founded, and a person reviews every finding.
A traditional penetration test is a snapshot. It's often what a rule or an insurer asks for, and it's out of date the next time someone ships a change. Automated testing makes it affordable to test again and again.
POINT IN TIME
One assessment of the applications and APIs you choose, with verified findings, business impact and fixes, then a retest to confirm the fixes. The report gives you the evidence a regulator, insurer or customer asks for.
CONTINUOUS
The same testing on a schedule, from regular runs toward continuous operation, set by your scope and budget. New releases get tested without anyone having to remember, and every finding's status carries forward until it's fixed.
Finding weaknesses is half the job. The other half is closing them and showing they stay closed.
Automated attack
Decima's AI adversary works through your applications the way an attacker would. A model agent runs in an isolated, Kali-style environment with curated security tools, and plans, executes, verifies and records evidence for each attempt. It stays inside the targets, testing windows and stop conditions you signed off on.
Defense
Hardening, monitoring and incident readiness for the systems being tested: cloud configuration review (Lennart is a CCSP), secure development practices (CSSLP), and AI-assisted forensics. Lennart's ISC2 Security Congress 2026 talk covered running Claude Code on servers as defensive tooling, from hardening to post-breach forensics.
Find, fix, retest
Every red-team finding becomes a blue-team fix, then a retest that confirms the fix worked. The finding's status carries into the next report, so you can show what was found, when it was fixed and that it stayed fixed.
Customer portals, booking and ordering systems, admin panels and the APIs behind them. We look for weaknesses an attacker could actually exploit, not a list of theoretical ones.
Chatbots, AI receptionists and agents that can take actions: prompt injection, what tools the agent is allowed to use, and whether it can reach data it shouldn't. Decima runs this as a pilot service.
Blue-team review of how your cloud accounts and servers are configured, who has access, and what is logged, so a finding in the application doesn't become a breach of everything behind it.
What the report gives you
See a sample Decima report.
Auto dealers, tax preparers, mortgage brokers and many CPA firms must run either continuous monitoring or an annual penetration test plus vulnerability assessments every six months. Firms holding information on fewer than 5,000 consumers are exempt from this part.
Businesses that store, process or transmit card data need penetration testing at least once a year and after significant changes.
Applications and renewals increasingly ask when you last tested your systems and what you fixed.
Larger customers and SOC 2 auditors often ask for a recent penetration test report before they sign.
This is general information, not legal advice. Penetration testing is one part of a security program; the rest (risk assessments, policies, a named security lead) is on our cybersecurity consulting page.
The testing itself is done by an AI agent with real security tools, attacking within the scope you approved. What makes it a penetration test rather than a scan is that each finding is proven: it's reproduced, evidence is collected, and a person reviews it before it reaches you.
A scan lists things that might be wrong. A penetration test shows which of them an attacker can actually use, and what they'd get. You get fewer, better findings, each with evidence and a fix.
A one-off test is a snapshot, which is often what a rule or an insurer asks for. Your applications change every month, though. Testing on a schedule, up to continuously, catches what a new release breaks before an attacker does. How often depends on your scope and budget.
Testing only runs inside the targets, time windows and stop conditions you approve in writing, and we agree in advance which systems are tested in production. If something looks risky, testing stops.
No. Testing starts only after a written, signed authorization that names exactly what may be tested.
We scope every engagement on a free 30-minute call first. Decima Systems publishes its own plans at decima.systems.
No. Testing runs remotely for businesses anywhere. Lennart meets clients in person across Sarasota and Manatee counties.
Tell us what you run and what's driving the question: a rule, an insurer, a customer or a worry. We'll scope a test that answers it.