Pentest-Tools.comOur story
It started on a balcony
Back in 2013, our founder Adrian Furtuna was a decade into his career as a penetration tester. He worked at KPMG, running assessments for financial institutions and telecoms across Romania and Europe. The work was rigorous. His tools were not (he didn’t blame them, though, because he’s a good engineer!).
Most of the workflow was manual. Open-source tools from Backtrack (the ancestor of Kali) were the industry standard... when they worked. Piping output from one tool into the next required scripting workarounds, and the only remote testing services available were obscure platforms Adrian didn't trust with client data.
Adrian did what engineers do: he built something for himself
The first version of Pentest-Tools.com ran from a Pentium 4 desktop server on Adrian's balcony: Debian Linux, a public IP, and a web interface over a handful of open-source tools. Basic, but always on, and always accessible.
When the first payment came in from someone he'd never met, something clicked. The frustration that drove him to build this was apparently universal. In 2017, Adrian formed the first team, entered the Innovation Labs startup accelerator in Romania, and won the grand prize. That's the moment we mark as the true birth of Pentest-Tools.com.
There are these two dimensions — the technical need, and the personal challenge.
Founder & CEO
We disagreed with an industry
A decade ago, the penetration testing industry had a scaling problem that nobody was seriously solving. (Sorry, not sorry.)
True security expertize is scarce. The pool of experienced penetration testers who could understand business context and interpret a vulnerability's real-world impact was too small and wasn't growing fast enough.
The tools dominating the market were making things worse. Vulnerability scanners returned sheets of version-based detections matched against CVE databases, with no validation a vulnerability was actually exploitable in that specific configuration.
So, we set out to democratize offensive security testing
We wanted it to be accessible not just to elite red teams, but to the internal security professional who also handles patching, incident response, and compliance.
Our conviction has always been that making security teams faster and more certain is worth more than flooding them with unverified data.
Not all vulnerabilities are created equal. When you receive a report with 100 vulnerabilities and you need to manually pass through each one, it creates more work than it helps you.
Founder & CEO
From good idea to global product
We built what offensive security needed
We developed our own DAST scanner
After identifying fundamental accuracy issues in existing web scanning tools, we made a decision: build our own scanner from scratch. Today, benchmarks place it among the top-tier solutions available anywhere and, because we own it entirely, we can improve it the moment something isn't working. But detection was never our end goal. Validation was.
We added proprietary exploitation
Next, we built Sniper, our proprietary exploitation engine, to complete the penetration testing cycle. When critical CVEs like Log4Shell emerged, we had working exploits in Sniper within 72 hours (now just 24h) - letting customers validate whether their infrastructure was at risk before attackers could reach it.
We automated workflows
Then came Pentest Robots: automated, chainable workflows that link reconnaissance, port scanning, fingerprinting, vulnerability detection, and exploitation into a single orchestrated assessment. We launched them at Black Hat Europe 2020 because all our tools live on one unified product, they share data natively - output from one flows directly into the next.
We kept a direct line to the people who do the work
Today, Pentest-Tools.com serves over 2,100 internal security teams, IT departments, and MSPs across 95 countries. Our product is integrated into the tools they use in their daily workflows: Jira, Slack, Teams, Vanta, and beyond.
The best validation is exploitation — otherwise it's just words. You need to prove it.
Founder & CEO
Proof over noise, every day
A bank's information security manager used Sniper after a critical vulnerability appeared in a core banking software. He got proof of exploitation, walked into the IT team's office, and the vulnerability was patched in two hours.
He told me this had never happened before. Whenever he came with vulnerabilities, the IT team said they were busy and would put it on the to-do list. With real proof, it was closed almost immediately.
Founder & CEO
Rooted in reality
That story captures what we actually deliver: not scan volume, but defensible, actionable evidence. Or, as we’ve come to think of it internally, ‘accuracy is the new product’.
Security teams are stretched. Typically, two or three people are responsible for the entire security posture of a complex organization, and they don't have time to triage noise.
They need tools that help them do the job fast, quietly, and with the least effort possible. We try to fill that need.
Founder & CEO
Every confirmed vulnerability in our product is validated
By that, we mean tested, not version-matched against a database. When something is marked confirmed, teams can act on it immediately. We ensure we embed new detections and exploits as they emerge, so customers can rely on us to be current.
The future is continuous and AI-native
We've done extensive research into where AI changes what's possible in offensive security - not as a feature add-on, but as a fundamental shift in how assessments are conducted. The difference between today's automated workflows and what's coming is adaptability. Our Pentest Robots follow predefined sequences. AI agents reason about what they find, adjust their approach in real time, and present decisions.
Autonomous penetration testing is a coordinated system of AI agents mimicking human testers, from reconnaissance to exploitation, and it’s already showing promising results internally. We're building with clear eyes about AI's limitations. We've built external validators that provide a second layer of verification on every result an AI agent produces - because confidence without proof is exactly the problem we set out to solve.
An autonomous penetration tester doesn't sleep. It can run every day if you want. Customers can have a continuous layer of protection, rather than a once-a-year engagement that's already outdated the next morning when a new vulnerability drops.
Founder & CEO
That’s the story so far, and we’re still writing it. Keep going to find out more.
- Meet the team
The people behind it
Engineers, pentesters, and researchers who use the product they build.
- Explore our research
What we're digging into
New CVEs, exploit write-ups, and original research from our security team.
- See what our product does
Proof, not promises
Run a scan, get a validated finding, and judge the evidence yourself.
