AI pentest FAQ

BreachLine is a SaaS platform for AI security testing. Set tasks, follow progress and review findings in your online workspace. AI work uses credits: Individual, Team and Business include a monthly allowance, and Enterprise credits are billed separately.

Yes. Our team can deliver a security assessment with an agreed scope and separate quote. Services are separate from software subscriptions.

Nebula is your autonomous AI security engineer inside BreachLine. It plans the task, uses tools and brings back findings with evidence.

Create an account at auth.breachline.io/register using your company email. Verify your email, set up two-factor authentication and review your company details. Sign the platform-use agreement, then select and pay for your plan. Before testing, define your targets and provide written authorisation for the scope. Personal and disposable email addresses are not supported.

Choose the systems to test, confirm your written permission and provide any required test accounts. Share the task in your workspace.

Set the task and scope. Nebula runs the test and records findings with evidence. Review the results, make your fixes and ask it to retest. Tests and retests use credits.

Nebula can plan and carry out several steps from one task. You set the scope and permissions, follow its work and review the results.

Nebula plans the next step, uses a tool, checks the result and adjusts its plan. You can follow its progress and give new instructions as it works.

Nebula uses browser, terminal and security tools in a sandbox. The task, approved scope and available connections determine which tools it can use.

Nebula can split a larger task into smaller jobs, run suitable work in parallel and bring the results together.

Project memory helps related conversations keep useful context. Nebula can refer to earlier findings and notes when continuing the work.

Yes. Send instructions in the conversation while Nebula works. You can ask for progress, add context or redirect the task within your approved scope.

All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Each customer's scan environment is isolated at the container level. Enterprise customers can deploy Nebula on-premise for complete data residency control with zero external telemetry.

Yes, always, and we cannot waive it. Testing a system without written authorisation is a criminal offence under the Computer Misuse Act 1990 in the UK, the CFAA in the US and equivalents elsewhere. Our Terms of Service require you to hold that authorisation before a scan starts.

Yes. BreachLine Labs Limited is a UK-registered company operating under GDPR. We process only the data necessary to perform scans, provide clear data retention policies, and support data deletion requests. Enterprise customers with on-premise deployment retain full data sovereignty.

Yes. Nebula maps findings to OWASP Top 10, PCI-DSS, NIST, and CWE in its reports. Mapping is a reporting feature, not a claim that BreachLine holds those certifications.

BreachLine Labs Limited is registered in England and Wales, headquartered at 60 Tottenham Court Road, Office 1377, Fitzrovia, London W1T 2EW. Cloud infrastructure is hosted in EU and UK regions by default, with configurable data residency for Enterprise customers.

Nebula investigates weaknesses in sign-in, permissions, data handling, APIs and application logic. Findings include evidence so you can review what happened and what to fix.

Yes. Connect a test account or provide the required credentials to check features behind sign-in, including user permissions and admin areas.

Yes. Test API access and data handling, or review exposed cloud services and configuration. Coverage depends on your approved scope and connected accounts.

Individual is £399 per month, Team is £899 per month and Business is £2,299 per month. Enterprise is £199 per seat per month (minimum five seats), and its credits are billed separately. Every plan includes one AI staff member and the Nebula engine. Individual, Team and Business also include a monthly credit allowance shared by the organisation; testing, investigations and retests use those credits, then prepaid top-ups. The full feature and allowance comparison is on /pricing.

Individual includes 400 monthly credits, 1 AI staff member and 1 named seat. Team includes 1,000 monthly credits, 1 AI staff member and 3 named seats. Both provide web, API, network and cloud testing, plus mobile testing on supported connected devices, using your credits. Unused monthly credits roll over for one month, capped at one month of the plan allowance. Additional work uses prepaid credits. Both plans include email support.

Business includes 2,800 monthly credits, 1 AI staff member and 10 named seats. Its unused credits roll over for one month, capped at one month of the plan allowance. Enterprise is £199 per seat per month (minimum five seats). Its credits are not included in the seat fee: they are billed separately, shared by the organisation, not multiplied by seats. Unused Enterprise credits roll over for one month. Both plans use the same security features. An additional AI staff member is £549/month. Enterprise: £199 per seat per month.

Retests, AI-written reports and questionnaire answers use your monthly allowance, then prepaid credits. On Enterprise, they use credits billed separately. A credit represents £1 of metered usage; the number of tokens varies with input, output and cached input. Your workspace usage page shows recorded tokens and credit charges.

There is no self-serve free trial. Book a guided demo through /contact to see the platform and discuss your testing needs.

Connect your Slack workspace and choose the access Nebula can use. Share updates and work with Nebula through the connected channels.

HTML reports include a summary, findings, evidence, severity and suggested fixes.

Yes. Use the APIs to connect BreachLine to your development workflow. The documentation at /docs covers authentication, supported endpoints and examples.

Scan data is retained for the duration of your subscription. Enterprise customers can configure custom retention. All data can be deleted on request in compliance with GDPR.

Yes. Configure email notifications in your workspace to receive updates about your security work.