PenLocal combines local AI with experienced pentesters from Warpnet
AI test agents ensure the coverage and speed of automated testing. A specialist checks every finding before it reaches you.
Schedule a no-obligation consultationView the packages
Results within hours·
✓ Scope check: 12/12 hosts authorized
Planner: Phase 1, reconnaissance & fingerprinting
Supervisor: 4 agents started
Findings: Reflected XSS in /search?q=
Findings: Path traversal in /files?filename=
✓ Validated by pentester remco.v
Report updated in customer portal
Next scan: in 6 days
A pentest is a snapshot, while your environment continues to change
Every release, new dependency or configuration change can introduce new risks. PenLocal makes continuous or periodic testing feasible, without you having to invest in in-depth analysis.
From scope to confirmed fix
Determine the scope
Together with Warpnet, you determine which systems are being tested and which ones remain outside the scope.
AI assessment
Test agents conduct reconnaissance, web and infrastructure testing, and secure code review.
Expert validation
A Warpnet pentester checks every finding before you see it.
Findings in your portal
Ernst, evidence and replication steps are immediately understandable to your team.
Retest
After a fix, Warpnet confirms that the problem has indeed been resolved.
How PenLocal compares to a traditional pentest
| Characteristic | PenLocal | Traditional, annual pentest |
|---|---|---|
| Frequency |  Available continuously or monthly |  Usually once a year |
| Lead time | Results within hours | Often a few weeks |
| Validation | Every finding verified by a specialist | Varies per supplier |
| Coverage | Pentesting, code review and monitoring in one platform | Often separate, purchaseable courses |
| Scope monitoring | Five independent technical security layers | Depending on the supplier |
| Retest | Part of every assignment | Not always included |
Local AI above public AI
PenLocal runs on local AI. Your data never goes to ChatGPT or any other public cloud provider.
Data stays within your walls
In public AI, prompts and documents go to third-party servers. Locally, that data never leaves your own infrastructure.
Regulation and sovereignty
The GDPR, data residency and sector legislation are demonstrably easy to comply with: you know exactly where the data is and who can access it.
Why this matters even more in pentests
Your data is the jewel in the crown
Scan results, network topology, and found credentials are exactly what an attacker is looking for. Those are not part of an external API, especially not before the patch.
Contracts often prohibit it
NDAs and rules of engagement determine who can see test data. Sending data to a public AI is then quickly a breach of contract.
No content filters that block work
Public models often refuse to do offensive work. A local model is fully prepared for pentests.
Also works in air-gapped mode
OT/ICS, critical infrastructure and defense networks are often tested offline. Local AI is the only option for that.
No logging by a third party
No evidence beyond your control of which vulnerabilities have been investigated.
Hybrid where possible, local where necessary
General, non-sensitive research (such as CVE databases) can be done via cloud AI. Everything related to customer data, scope of exploits, etc. remains strictly local. In pentesting, that is practically all the work.
Your choice of AI engine
Not every organization has the same requirements regarding data sensitivity. We help you weigh the tradeoffs between capacity, costs, and data sovereignty.
Five independent layers keep the AI within scope
Each agent's command is first checked and only then executed.
One platform for full coverage
Reporting that aligns with your compliance obligations
You will receive a ready-made report in Dutch or English, with substantiated findings and concrete recommendations. The findings can be automatically linked to recognized frameworks.
ISO 27001:2022 (Annex A)DigiD / NCSC web application standards
Packages that come with your testing needs
As a SaaS service, or completely on-premise when you prefer a custom hosting environment.
Basic
1 pentest per quarter, blackbox, greybox or whitebox of your choice
€ 1.250 /month
Standard
3 pentests per quarter, blackbox, greybox and/or whitebox of your choice
€ 1.850 /month
Premium
3 pentests per month, blackbox, greybox and/or whitebox of your choice
€ 2.750 /month
Platinum
Unlimited number of pentests per month, regardless of the type
€ 6.000 /month
On-Premise
On-site hosted with you, including further development of the application
€ 19.950 /month
- Rates based on a 12-month contract period, tacitly extended by 6 months unless one month before expiration it is cancelled in writing.
- Monthly rates are billed in advance; payment term is 30 days.
- Reporting and discussion take place remotely. NLdigital Terms and Conditions 2020 apply.
- All prices mentioned are monthly amounts in euros, excluding VAT.
PenLocal FAQs
Is a retest included?
Yes, for every assignment. After a fix has been implemented, Warpnet confirms with a second test that the vulnerability has actually been resolved.
Will the AI remain within the agreed scope?
Yes. Five independent layers prevent a test from going beyond its scope or causing damage: scope enforcement, a network egress firewall, blocking destructive commands, prompt injection quarantine, and human-in-the-loop.
Can I choose between self-hosted and cloud AI?
Yes. For the most sensitive environments, PenLocal can run entirely self-hosted (Ollama, vLLM), so test data never leaves your environment. Where maximum test depth matters, cloud frontier models like Claude or ChatGPT can be deployed.
Is every finding checked by a human being?
Yes. A Warpnet pentester validates every finding before it appears in your portal. Therefore, you do not receive unfiltered machine output.
Does the reporting comply with ISO 27001 and DigiD?
Findings can be automatically linked to ISO 27001:2022 (Annex A) and the DigiD / NCSC web application standards, with a pass/fail judgment and supporting documentation for each measure.
Discuss the scope of your first assessment
We decide which package and which AI engine best suit your organization.
You will hear from one of our experts within one business day.