SaaSFort
Launching on Product Hunt soon -- follow for early-access & launch-day perksFollow →
NIS2 deadline: Oct 2026 — 17,500 companies already late

Your external security posture, measured continuously. Evidence, not assertions.

Every finding is returned with its raw evidence and its timestamp, mapped to OWASP Top 10 (2021), NIS2 Article 21(2), ISO/IEC 27001:2022 Annex A and DORA. An automated external-surface analysis, complementary to a manual penetration test.

No account required · Free forever · Results in under 60 seconds

View pricing → Or get the free SaaS Security Playbook (PDF)
< 10s
First scan results
66
Security checks per scan
€49/mo
Starting price

66 checks · 25 categories · A–F grade

OWASP, NIS2 & ISO 27001 mapping included

Scan Now
66 controls · 25 categories OWASP · NIS2 · ISO 27001 · DORA Raw evidence and timestamp per finding No credit card required

Built for SaaS, fintech, healthtech, and MSPs across the EU

NIS2 Article 21ISO 27001 Annex AOWASP Top 10GDPR-readySecure payments by StripeNo credit cardCancel anytime

How It Works

From measurement to an auditable file in 3 steps

No onboarding call. No agent to install. Enter your URL and let SaaSFort handle the rest.

Step 01

Scan Your Domain

< 1 hour

Enter your URL — SaaSFort runs a full OWASP Top 10, CVE, SSL/TLS, and API security scan automatically. No agent to install, no config required.

Step 02

Get the Evidence Report

< 24 hours

A PDF that carries each finding with its raw evidence and timestamp, mapped to OWASP Top 10 (2021), NIS2 Article 21(2), ISO/IEC 27001:2022 Annex A and DORA.

Step 03

Hand it to the reviewer

Days, not weeks

A security department can verify each observation, contest it, and have the check re-run on the same control set. The file stands on its own.

Product

Measurement that holds up under review

Every capability exists for one reason: a finding a reviewer can verify, contest and re-run.

Continuous Web Scanning

OWASP Top 10, CVE tracking, SSL/TLS, and API security — automated on a schedule matching your release cadence. Weekly, daily, or continuous.

Evidence Reports

Each finding carries the raw evidence behind it — observed headers, certificate chain, negotiated cipher suites, DKIM selectors tested, response excerpts — and its timestamp.

Remediation Copilot Soon

Fix guidance ordered by measured exposure, with the observed evidence attached to each recommendation. Code snippets per stack included.

Exposure Confirmed, Not Guessed

Any exposed file or sensitive path is confirmed by content signature and compared with a reference response, which rules out catch-all handlers and soft-404s.

CI/CD Integration

Connect to GitHub Actions, GitLab CI, or Jenkins. Catch vulnerabilities before they reach production — and before your customer finds them.

NIS2 & ISO27001 Mapping

Map findings to compliance frameworks automatically. Answer security questionnaires in hours, not weeks. Available on Scale plan.

Evidence standard

What a security department gets, check by check

  • 66 controls across 25 categories

    A fixed, published control set. The same domain measured twice yields the same result, so a finding can be contested, re-run and compared.

  • Raw evidence and a timestamp on every finding

    Observed headers, certificate chain, negotiated cipher suites, DKIM selectors tested, response excerpts. A reviewer verifies the observation instead of trusting a score.

  • Mapped to OWASP Top 10 (2021), NIS2 Article 21(2), ISO/IEC 27001:2022 Annex A and DORA

    Mapping happens in the engine, so the export goes to the auditor without re-formatting.

  • Exposure confirmed by content signature

    Any exposed file or sensitive path is confirmed by signing the content and comparing it with a reference response, which rules out catch-all handlers and soft-404s.

SaaSFort performs automated external-surface analysis. It is complementary to a manual penetration test, not a replacement for one, and it does not detect business-logic flaws.

Context

What a third-party security review costs today

Published figures, each with its source. Nothing here comes from our own customer base.

78%

of B2B SaaS deals are delayed by security reviews

Vanta State of Trust Report 2024
€5K–€20K

cost of a single traditional pen test engagement

SANS Pen Test Survey 2024
15–20%

of CTO time spent on security questionnaires during enterprise sales

Cisco CISO Benchmark Report 2024

17,500 German companies missed the BSI NIS2 deadline. Enforcement is active — prove your compliance posture today.

Try a Free Scan

Why SaaSFort

Where an automated external analysis fits

A manual penetration test and an automated external analysis answer different questions. This is what each one covers, and where SaaSFort sits.

Manual Pen Test Detectify / Intruder SaaSFort
Price €5K–€20K per test €90/mo €49/mo
Time to first report 4–8 weeks < 24h (dev only) < 10s scan · < 24h Evidence Report
Raw evidence per finding Yes, manual write-up Partial Yes, with timestamp
Continuous monitoring No Yes Yes
CI/CD integration No Yes Yes
NIS2 & ISO 27001 mapping No No Yes
Business-logic flaws Yes No No — out of scope
Synack, HackerOne Detectify, Intruder, Probely Try Free Scan
Free · No card · Auto-refreshing

Embed your security grade badge on every page you ship.

Publish the grade you actually measured. Drop a live badge on your homepage footer, security page, vendor portal, or docs, and every visitor click runs a fresh measurement of your domain. The badge always reflects the latest scan, never a cached claim.

  • Auto-refreshing: badge always shows your latest scan grade
  • One <img> tag. No JS, no iframe, no tracker
  • Works in your footer, GitHub README, vendor portal, or trust page
Scan to unlock your badge How the badge works

No account required for the scan. Badge becomes available the moment your scan finishes.

Live preview saasfort.com
SaaSFort security grade badge for saasfort.com 
<a href="https://saasfort.com/scan?domain=yourapp.com">
  <img src="https://api.saasfort.com/api/widget/badge?domain=yourapp.com"
       alt="SaaSFort Security Grade" />
</a>

Replace yourapp.com with your domain after your first scan. The badge automatically reflects your latest grade.

SaaS Security Leaderboard

How do Stripe, Slack, GitHub score on NIS2 external checks?

Public grades for 8 well-known SaaS domains: HTTP headers, DMARC, DNSSEC. See who passes, who fails, and where your own domain lands.

View leaderboard →

Free Whitepaper -- 30 Pages

The SaaS Security Playbook 2026

Enterprise buyers check 7 security control categories before signing. 78% of SaaS deals are delayed by security reviews. Our free playbook shows you exactly how to prepare -- with a 30-day action plan from Grade C to Grade A.

30 pages
8 security domains
30-day action plan
Download Free Playbook Free -- no email required to preview

Pricing

Priced per measured perimeter.

Starter €49/month, Growth €149/month, Scale €399/month. 14-day free trial, no credit card required.

Annual billing bills 10 months instead of 12. An automated external-surface analysis is complementary to a manual penetration test, not a replacement for one.

See all plans

Frequently asked questions

How is SaaSFort different from Detectify or Intruder?
Generic scanners produce developer-facing reports with CVE IDs and CVSS scores that procurement teams can't interpret. SaaSFort generates Evidence Reports formatted for DDQs, vendor risk assessments, and enterprise procurement packages. Every finding carries the raw evidence behind it and its timestamp, so a reviewer can verify it rather than take it on trust.
How fast is the first scan?
First scan results are ready in under 10 seconds. A full Evidence Report — formatted for procurement — is generated in under 24 hours. No waiting weeks for a traditional penetration test.
Is this a replacement for a traditional pen test?
SaaSFort is continuous automated scanning optimized for enterprise sales evidence. It covers OWASP Top 10, CVE tracking, API security, and SSL/TLS — addressing 80%+ of enterprise security questionnaires. Most customers use SaaSFort between annual pen tests to maintain continuous evidence.
How does the Evidence Report help with procurement?
Our AI generates a report narrative tailored to non-technical stakeholders (legal, procurement, CISO teams). It maps findings to business risk, includes remediation timelines, and is formatted to answer standard DDQ questions. Enterprise buyers recognize and trust the format.
Can I integrate SaaSFort into my CI/CD pipeline?
Yes, on Growth and Scale plans. We support GitHub Actions, GitLab CI, and Jenkins. Scans run on every push and results post to Slack or email.
Where is my data stored?
Scan results are stored encrypted on EU infrastructure (AWS eu-west-3, Paris). We never share or sell your security data. You can request deletion at any time.
NIS2 Deadline
October 2026

29,000+ EU entities must comply with NIS2 cybersecurity requirements. SaaSFort maps your scan results to NIS2 controls automatically. Prove compliance before the deadline.

Am I in scope? Scan my domain

Reference guides: SaaS Security Leaderboard: public NIS2 grades ·Security scan by use case ·NIS2 supplier questionnaire ·Prove SaaS security to enterprise buyers ·NIS2 audit evidence requirements ·NIS2 supply chain Article 21 ·How to answer a security questionnaire fast ·Vendor security assessment guide ·What a NIS2 audit costs

Measure your external surface.

Every finding comes back with the evidence behind it and its timestamp. Under 60 seconds.

No account needed · Results in seconds · Free forever

View pricing → Or get the free Security Playbook