See what attackers see. Fix it before they strike.

No. We translate technical findings into actionable language anyone can understand. Hackal is built for resource-constrained startups, non-technical founders, and growing businesses that need enterprise-grade monitoring without an enterprise security team. Most security tools are built by experts, for experts. We built ours for everyone else: the teams juggling product, support, and compliance without a CISO in sight.

Penetration tests are comprehensive, point-in-time assessments that demand real budgets ($10k–$75k) and careful planning. Hackal complements pen testing with continuous monitoring that surfaces risks between formal test cycles before they become incidents.

Enterprise EASM platforms are built for large security teams inventorying thousands of assets across sprawling infrastructure — and priced to match, often $30,000–$100,000 a year. Hackal covers the exposures that actually get startups and SMBs breached, without that weight or cost. A few things set it apart: it doesn't just map your perimeter, it actively tests it with DAST, authentication, and attack-resistance checks that show what an attacker really gets; it's built to be run by people with no security staff, turning findings into prioritized, plain-English fixes instead of a CVE firehose; and it's live in minutes with no agents or tuning, at a fraction of enterprise pricing. The honest trade-off: the big platforms do more on large-scale asset discovery and inventory, so if you're tracking thousands of unknown assets with a team to manage them, you may want one. For the exposures attackers find first — handled without an enterprise budget — that's where Hackal fits.

No. Hackal monitors your external attack surface — the same view attackers have. We never touch your internal systems, require network access, or install agents. That means zero infrastructure impact and zero disruption.

Yes. Our continuous monitoring helps satisfy specific security controls across multiple frameworks, though it doesn't replace formal audits or certifications. Hackal isn't a CPA firm, ISO auditor, or PCI QSA, so we don't issue attestations. What we provide is continuous external monitoring and time-stamped evidence you can show your auditor:

• SOC 2 (2017 TSC): supports CC6 (logical access), CC7 (system operations & monitoring), and CC8 (change management) via perimeter monitoring, passive DAST, script-integrity/CSP reporting, domain threat detection, TLS assessments, and two-year evidence retention.
• ISO/IEC 27001:2022: supports A.8.8 (technical vulnerabilities), A.8.16 (monitoring), A.8.9 (configuration management), and A.5.23 (cloud security) by tracking exposed services, leaked secrets, misconfigurations, weak TLS, and suspicious certificates.
• PCI DSS v4.0: assists with Req. 6.4.3 (payment-page script inventory), Req. 11.6.1 (tamper detection), and Req. 4.2.1.1 (trusted-certificate inventory) through script and certificate monitoring.

Final compliance depends on your broader controls and a qualified assessor's judgment.

No. Hackal is not a WAF or reverse proxy and never sits inline with your traffic. The platform primarily observes and scans externally. Active tests that interact with your systems — our Attack Resistance Testing — run only after you've verified site ownership and explicitly opted in, and never include denial-of-service or destructive attacks.

Less than five minutes. Add your site(s), optionally configure notifications, and you're up and running — no agents, nothing to install. One optional HTTP header unlocks CSP reporting in Script Integrity Monitoring.

We provide a demo environment so you can explore the platform before subscribing with no credit card required. There's no time-limited trial, but pricing is monthly or yearly with no long-term commitment.

No. We're not fans of "Contact Sales" buttons, nickel-and-diming, or upsells. The plan includes the full platform — current features and future additions alike.

A site is a publicly reachable, fully qualified domain name (FQDN) such as yourcompany.com. We generally recommend monitoring an apex (root) domain rather than a single subdomain (e.g. yourcompany.com instead of api.yourcompany.com) for broader coverage.

Contact us at sales@hackal.io for custom enterprise plans. We're focused on startups right now, but we can accommodate larger monitoring needs.

When you start a subscription you can create a team and invite others to join. Team members review findings, and administrators add and manage sites so security work is shared across engineering, operations, and leadership.