Risk score 82/100 Open
Cybersecurity platform
See every exposure before an attacker does.
Pentensity watches every identity, device and key your company runs on, finds what is exposed and closes it before it turns into a breach.
SOC 2 Type II · ISO 27001 · 1,400 security teams
Sample findings, demo data
Live · exposures closed today
18,402
Across every customer workspace, counted as each one is verified closed.
Trusted by 1,400 security teams
Read their storiesLive findings
Found at 09:41.
Closed at 09:45.
Pentensity does not hand you a list to work through. Each finding arrives with its owner, its fix and a clock, and most are closed before anyone opens a ticket.
- Median time to close: 4 min
- 92 % closed without a ticket
- Every fix is logged and reversible
- 09:41
Stale admin account
Left the company 212 days ago and is still a global admin
Identity · High
open
- 09:38
Secret in a build log
A database password printed by a CI job
Secret · Critical
open
- 09:35
Forwarding rule to a personal inbox
Finance mail copied outside the company
Identity · High
open
- 09:32
Expired TLS certificate
The partner API certificate lapsed last night
Network · Medium
open
- 09:29
Unused service account
Owner role on the billing project, idle for 96 days
Identity · High
open
- 09:26
Public S3 bucket
Customer exports readable without a login
Cloud · Critical
open
- 09:23
Phone · no screen lock
Reads company mail without a passcode
Endpoint · Low
open
Sample findings, demo data
Coverage
Four surfaces.
One watch.
Every employee, contractor and service account, with what each can reach and when it was last used.
- Stale accounts
- MFA gaps
- Shared passwords
- Admin sprawl
Identity · High
Stale admin account
Identity · Medium
Shared admin password
Identity · High
Contractor · MFA off
Products
Five products, one list of what is exposed.
Start with the surface that worries you most. Every product writes into the same findings list, so nothing has to be stitched together later.
1IdentitiesOpenIdentity
Every account, human or machine, and what it can reach.
- Sources
- Okta, Entra ID, Google Workspace
- First findings
- under 1 hour
- Fix
- one click or a ticket
2DevicesOpenEndpoint
Laptops, phones and servers that have fallen behind.
- Sources
- Jamf, Intune, agent
- Platforms
- macOS, Windows, Linux, iOS, Android
- Agent footprint
- 38 MB
- CloudOpen
Cloud
Buckets, ports and roles that answer to the whole internet.
- Sources
- AWS, Azure, Google Cloud
- Access
- read-only role
- Checks
- 640 and growing
- Code & secretsOpen
Secrets
Keys and tokens before they leave the building.
- Sources
- GitHub, GitLab, Slack, Jira
- Detectors
- 310 key types
- Median time to revoke
- 4 minutes
- Detection & responseOpen
Respond
One timeline from first signal to closed.
- Alerts
- Slack, PagerDuty, email
- Median time to contain
- 4 minutes
- Retention
- 13 months
One incident, two endings
The same leaked key. Two very different endings.
A cloud key is pushed to a public repository on a Tuesday afternoon. What happens next depends on whether anyone is watching.
0
Days before anyone noticed
Without Pentensity
Found on day 212Day 0
Key pushed to a public repo
A deploy script with a live cloud key lands in a public repository.
Day 3
Copied by a scraper
Automated scanners pick the key up. Nobody is told.
Day 41
First quiet login
The key is used from a new country to list storage buckets.
Day 130
Customer records copied
1.2 million rows leave over nine nights.
Day 212
Found by a customer
A customer reports their data for sale. The clock starts now.
With Pentensity
✓ Closed in 4 min0:00
Key pushed to a public repo
0:40
Finding opened
1:30
Owner paged
3:10
Key revoked
4:00
Closed
Integrations
Connects to what you already run.
Read-only access, no agents to roll out for the first findings. Most teams connect their identity provider and one cloud account in the first hour.
0 / 12 connected · Read-only by default · no credentials stored
In numbers
What gets measured gets closed.
Averages across every customer over the last twelve months. Your own numbers sit on the first screen of the product.
Mean time to detect
4 min
From the moment something is exposed to the moment its owner is told.
Findings closed
1.28M
Closed by the person who owns the asset, not parked in a queue.
Coverage
99.2%
Of identities, devices, cloud accounts and repositories under watch.
Security teams
1,400
From ten-person start-ups to regulated groups in 31 countries.
Figures are sample data
Customers
Closed cases, in their own numbers.
Four teams, four different problems. Each one started with a sweep and a list they did not expect.
Closed
340
orphaned accounts closed in week one
Pricing
One price per seat. Nothing hidden.
Move the slider to your headcount. Every plan covers every identity and device those people use.
Billing
Two months free yearly
Team
For companies getting their first clear picture.
$600 per month
$5 per seat / month · billed yearly
- Identity and Endpoint
- Daily sweep
- Slack and email alerts
- 90 days of history
- Community support
Business
Most chosenFor teams that have to prove it to an auditor.
$1,080 per month
$9 per seat / month · billed yearly
- Everything in Team
- Cloud and Secrets
- Continuous sweep
- Jira and PagerDuty
- SOC 2 and ISO 27001 evidence
- 13 months of history
Enterprise
For regulated companies with their own security team.
$1,800 per month
$15 per seat / month · billed yearly
- Everything in Business
- Respond with custom playbooks
- Single sign-on and SCIM
- Private data region
- Named engineer and 1-hour response
More than 1,000 people, or a private data region? Talk to sales
What teams say
The first sweep usually pays for the year.
Security and IT leads on what turned up in week one, and what they stopped worrying about after.
Closed 01
“The first sweep found a global admin who had left the company seven months earlier. That one finding paid for the year.”
Questions
Asked before every rollout.
What security and IT teams want to know before they connect the first source.
Connect your identity provider and most teams see their first findings in under an hour. Cloud accounts and device managers each add a few minutes. Nothing is installed on a server to get started.
Start here
Run the sweep on your domain.
Tell us where to look. We set up a read-only connection with you on a short call, and you see your own findings the same day.
We will sweep
- Identity providerNot connected
- Cloud accountsNot connected
- DevicesNot connected
- Code repositoriesNot connected