Skip to content
Book a demo

Hify AttackHify Defense

Find out where
AI
would attack
your company,
before anyone
else does.

Our technology tests your sites and APIs like a top-tier attacker. In your code, every change is reviewed with context before it reaches production.

Book a demo See the products

Hify Attackapi.example.com

Testing

  1. Read another account's invoiceGET /api/invoices/demo-02

    Decision: Reproducedgoes to the researcher

  2. Open the internal panelGET admin.example.com

    Decision: Blockedoutside the authorized scope

  3. Use the session after logging outPOST /api/logout

    Decision: In validationwaiting for the researcher

  4. Test the search fieldsGET /api/search

    Decision: Queuedwaiting for your approval

[02] Proof

Count on people who live and breathe cybersecurity.

Findings are reviewed by researchers recognized by Apple, Microsoft and Google.

HackerOne rankingBrazil

Top 2

among researchers in Brazil in 2026

2026
2nd place in Brazil
2025
3rd place in Brazil
Bug bounty
more than 1 million earned

Lucas SouzaCo-founder, Chief Offensive Security

Hall of Fame

Top companies where we found vulnerabilities

  • NASA
  • GitLab

Companies our team has reported vulnerabilities to

[03] Products

Two products. One security cycle.

01for your applications and APIs

Hify Attack

AI agents test the sites and APIs you authorized. Every finding arrives reviewed, with reproducible proof.

Explore Attack

02for your code

Hify Defense

Reviews every code change with context and suggests the fix right in the pull request.

Explore Defense

Hify Attack for your applications and APIs Product 1 of 2

[04] How it works

AI agents attack. A specialist confirms.

  1. We test the application

    AI agents attack the sites and APIs you authorized.

  2. A researcher reviews

    Every finding goes through a person before it reaches you.

  3. Your team fixes

    The finding includes the steps to reproduce and to fix it.

  4. We retest

    We repeat the attack to confirm the flaw is closed.

Start with one application. The others come later, in the risk order you define.

[05] Cadence Hify Attack

One pentest a year can't keep up with change.

Your application changes every week. At Hify, every relevant change triggers a test.

The 52 weeks of a sample year. Annual pentest: testing in the first three weeks, then 49 weeks without a test. With Hify: tests throughout the entire year.
  • week with a test
  • week without a test

PCI DSS v4.0.1, req. 11.4, requires a pentest at least every 12 months and also after any significant change.

[06] Finding Hify Attack

Every finding comes with proof.

No list of alerts. Your team gets what was exploited, how to fix it, and confirmation that the fix worked.

HFY-0142

Read access to another account's data

Severity: High

Proof

Account A read account B's data.

Request made by account A

GET /v1/accounts/7f3c…e21
Authorization: Bearer ‹account A›

Response with account B's data

200 OK
{ "nome": "Mar*** S***",
  "cpf": "***.***.***-12" }

Fix

Check that the account belongs to whoever is asking, before responding.

Suggested snippet

if (account.owner !== user.id)
  return 404

Retest

Fixed on Sep 25 · confirmed by the same attack

Before200 OK

After404

[07] Platform Hify Attack

One screen for those who decide. Another for those who fix.

The board sees whether risk is going down. The technical team sees what to fix first.

For those who decide

Risk index
2 out of 100
Open criticals
0
Time to fix
3 days

Open risks per month

  1. 22Mar
  2. 17Apr
  3. 12May
  4. 8Jun
  5. 5Jul
  6. 3Aug
  7. 2Sep

For those who fix

  1. HFY-0160 Password reset link works more than once Severity: High Owner: Accounts team fix by Oct 2
  2. HFY-0151 Customers can be identified by their tax ID Severity: Medium Owner: Accounts team in retest
  3. HFY-0157 Daily limit bypassed with simultaneous requests Severity: Critical Owner: Cards team fixed on Sep 25
  4. HFY-0142 Read access to another account's data Severity: High Owner: Accounts team fixed on Sep 25
The executive report and the audit evidence come from the same screen.

Hify Defense for your code Product 2 of 2

[08] Code review

A review of every code change, with context.

Defense reads the change together with the services it touches and explains the risk to its author, before production.

Pull request #128 Invoices endpoint

Fixed before production

src/api/invoices.ts lines added: +5

12export async function getInvoice(req, res) {
13+const invoice = await db.invoices.find(req.params.id);
14+if (invoice.accountId !== req.session.accountId) {
15+return res.status(403).end();
16+}
17+return res.json(invoice);
18}

Hify Defense bot

This route returns the invoice without checking whether it belongs to the logged-in account. Any authenticated user can read another account's invoice by changing the id.

Suggested fix

+if (invoice.accountId !== req.session.accountId) {
+return res.status(403).end();
+}

Suggestion applied

  1. Installs via GitHub App

    On the repository you choose.

  2. Replies in the pull request

    Explains the risk and suggests the fix where the code is reviewed.

  3. Your team decides

    Your developers approve every change before it goes to production.

[09] Control

Nothing leaves the scope you approved.

An autonomous agent is only safe with limits. Yours become policy, checked on every request.

  • Approved scope

    Hosts, routes, test accounts, schedule and speed.

  • Everything logged

    Every request with its response, exportable for audit.

  • You pause

    One button on the dashboard stops the run immediately.

Blocked before leaving

  • /v1/admin/*
  • /payments/*
  • third-party services

Within scope

  • app.example.com
  • api.example.com/v1

[10] Radar

A new flaw just went public. Radar tells you if it affects you.

Radar monitors in real time more than 200 sources where cybersecurity researchers around the world publish what they find, and works out how each vulnerability affects your applications.

  1. Monitors

    More than 200 sources, in real time.

  2. Matches

    Every new flaw against your applications.

  3. Prioritizes

    First, what needs action today.

Open Radar
Radar example: five flaws published today. Three affect your applications and two do not.

Live

200+ sources

  1. Flaw lets attackers log in without a passwordCriticalLogin library

    Act todayAffects 2 applications

  2. Tampered release steals credentialsHighOpen source package

    Does not affect youYou don't use this package

  3. Flaw already used in real attacksHighWeb server

    This weekAffects 1 application

  4. Customer data leakMediumThird-party service

    Does not affect youYou don't use this service

  5. Flaw exposes another account's dataCriticalAPI framework

    Act todayAffects 1 application

[11] Integrations

The finding arrives where your team already works.

Also by email, WhatsApp, API, webhooks and single sign-on (SSO).

  • Jira
  • Slack
  • Microsoft Teams
  • GitHub
  • GitLab
  • Claude Code
  • Cursor
  • Codex
  • GitHub Copilot
  • Windsurf

[12] Comparison

Pentest depth, at the pace of your changes.

Comparison between annual pentest, scanner, bug bounty and Hify
Criterion Annual pentest Scanner Bug bounty
Frequency Once a year On every build While the program runs In cycles and on every relevant change
Finds business logic flaws Yes Partial Partial Yes
Delivers reproducible proof Yes Partial Yes Yes
Reruns the attack after the fix Partial Yes Partial Yes
Fits into your deploy No Yes No Yes
Reviews every code change before production No Partial No Yes
Predictable cost Yes Yes No Yes

For internal networks, social engineering and physical testing, traditional pentesting is still the way to go.

[13] Team

Who builds Hify.

Four co-founders building the platform, with an advisor from Nubank's board.

  • Co-founder, CEO

    Igor Gontijo

    Founded, scaled and sold Hackr Ads, a platform that managed more than R$ 380 million in ads. Acquired by Conta Simples in 2022.

  • Co-founder, CPO

    Lucas Fonseca

    Experience building AI systems. Security consultant at Dreamer, acquired by Meta in 2026.

  • Co-founder, Chief Offensive Security

    Lucas Souza

    Distinguished hacker, with more than 1 million earned in bug bounties. Top 2 on HackerOne in Brazil in 2026, with experience in DevSecOps teams.

  • Co-founder, Chief Research & Development

    João Costa

    Former developer who worked in AppSec at Mercado Pago, on the team that builds application security solutions for Mercado Livre. Built a proprietary penetration testing harness with Lucas Souza.

Advisor

Rogério Calderón

Member of Nubank's board of directors and chair of its risk committee.

[14] FAQ

Questions before the demo.

Does it replace manual pentesting?

For web applications and APIs, Hify tests far more often than an annual pentest, and every finding goes through a specialist. Internal networks, social engineering and physical testing are out of scope: for those, manual pentesting stays in your plan.

Does it replace the scanner?

No, it complements it. A scanner looks for known patterns, one request at a time. Hify follows multi-step paths with a real session, tests the application's business logic and delivers every finding with proof.

Which environment do the tests run in?

In the environment you define in the scope, with a time window, a requests-per-second limit and destructive methods blocked.

Where is the test data stored?

Where it is stored, for how long and who has access are answered in the security questionnaire, under a confidentiality agreement, before any sensitive data is involved. In the evidence, personal data appears masked.

Do I need to provide credentials or code?

Not to get started. You can begin from the external view or with two test accounts, which already show whether one account can read another's data. Code comes in when you authorize it, and the test then sees more.

What if nothing is found?

No findings does not mean a secure environment. The report records what was tested, with which access, and what was left out and why.

How does pricing work?

Per application, according to the plan. It depends on each application's complexity, the frequency of cycles and the level of access. The price is set after the demo; there is no public price list.

[15] Contact

Watch Hify attack first, with your authorization.

A demo with the platform running.

Or write to igor@hify.ai.