OnSecurity

What OnSecurity does

OnSecurity Technology Limited is a Bristol-based, CREST-accredited offensive security company that operates an AI-augmented penetration testing platform accessible via app.onsecurity.io. The company combines AI-driven automation with manual testing by certified ethical hackers (founders collectively hold 40 years of professional experience) to deliver web, mobile, cloud (AWS/Azure/GCP), internal/external infrastructure, LLM/AI red team, physical, social engineering, and phishing engagements, alongside continuous vulnerability scanning (Scan) and OSINT-based threat intelligence (Radar).

Revenue is generated through two complementary mechanics: usage-based hourly pentesting with cash-balance portability and free retesting during an Aftercare Period, and subscription services (Scan and Radar) billed monthly or annually with auto-renewal. A combined subscription bundle and Split Billing option (12 monthly instalments) consolidate these into a single recurring payment. The go-to-market blends a self-serve product-led motion (instant quote generator, online portal) with enterprise field sales for complex accounts, enabling both SMB transactional volume and mid-market/enterprise contract growth.

OnSecurity serves organisations across healthcare, fintech, retail/e-commerce, telecommunications, education, automotive, and technology verticals, with named customers including Lidl, Fenergo, Countingup, YuLife, Incident.io, Marshmallow, OneTouch Health, and Talon Outdoor. The company holds ISO/IEC 27001 certification, stores client data in UK/EU ISO 9001/27001/27018-compliant data centres, and is headquartered at Runway East, 1 Victoria Street, Bristol, operating with a headcount band of 11-50.

Name

OnSecurity

Legal name

OnSecurity Technology Limited

Website

https://onsecurity.io

Company type

Private

Founded year

2016

Operating status

Operating

Headcount range

11–50 employees

Short description

OnSecurity is a Bristol-based, CREST-accredited provider of AI-augmented penetration testing, continuous vulnerability scanning, and threat intelligence, delivered via a self-serve platform to SMB, mid-market, and enterprise customers across healthcare, fintech, retail, telecoms, education, automotive, and technology verticals.

Ownership category

akta.pro rank

Product category

Penetration Testing Services

NAICS

Investigation and Security Services (5616), Testing Laboratories and Services (541380)

SIC

Services-Testing Laboratories (8734), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Vulnerability Management & Penetration Testing Services (BPAEADAD)

akta.pro secondary industries

Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC), Vulnerability Assessment, Security Audits & Compliance Testing (BPAKAHAG)

Keywords

• Penetration testing services
• Vulnerability scanning
• Threat intelligence
• AI security testing
• CREST approved pentesting

Headquarters

HQ city

Bristol

HQ country

United Kingdom

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Penetration Testing (Hourly): Manual penetration testing services billed by the hour. OnSecurity works in hours rather than days, quoting to the nearest hour without rounding up to the nearest day. Hourly rate is fixed at booking time. Clients purchase hours in advance via the portal cash balance or split billing. Free retesting within the Aftercare Period (7 days) and for 60 days post-completion at the same hourly rate.
2. Subscription Services (Scan & Radar): Ongoing vulnerability scanning (Scan) and threat intelligence (Radar) services offered as subscriptions with monthly or annual billing periods. Auto-renews until cancelled. Clients can cancel any time via the portal.
3. Platform/Software Fees: OnSecurity includes platform fees for use of its proprietary software, partially in lieu of manual efforts. Platform fees are not additional costs and replace previously manual efforts. Included in overall service pricing rather than charged separately.
4. Combined Subscription Bundle: Pentesting and scanning payments can be combined into one centrally managed monthly payment, providing a single subscription covering AI-augmented pentesting, continuous vulnerability scanning, and threat intelligence.

Pricing tiers

Go-to-market motion3 records

Distribution channels3 records

Marketing channels7 records

Core offering

OnSecurity operates an AI-augmented penetration testing platform that delivers CREST-approved manual pentesting by human ethical hackers combined with automated vulnerability scanning and threat intelligence. Services span web, mobile, cloud, external/internal infrastructure, LLM/AI, physical, social engineering, and phishing assessments, all managed through a self-serve web portal (app.onsecurity.io) with instant quoting, real-time reporting, and continuous monitoring between scheduled tests.

Product overview

OnSecurity is an AI-augmented penetration testing platform and managed security services provider. The core offering is a subscription-based all-in-one service combining AI-driven automation with CREST-approved human penetration testers. The platform integrates penetration testing, continuous vulnerability scanning (Scan), threat intelligence and OSINT gathering (Radar), and real-time reporting into a single managed service accessible via the app.onsecurity.io portal. Individual penetration testing services span web application, mobile application, cloud security (AWS/Azure/GCP), external and internal infrastructure, LLM & AI red teaming, physical penetration, social engineering, and phishing simulation. The platform supports instant self-service quoting, real-time tester communication (in-platform and via Slack), and free retesting of resolved findings. Services are available on subscription or ad-hoc hourly basis.

Differentiator

Problem solved

Functional benefit

Products and services

• Penetration Testing Services CREST-approved manual penetration testing covering web applications, mobile applications, cloud environments (AWS, Azure, GCP), internal and external infrastructure, and AI/LLM systems. Delivered by human ethical hackers augmented with AI automation and accessed through the app.onsecurity.io portal.
• Web Application Penetration Testing Security assessment of web applications, web servers, and websites to identify vulnerabilities such as SQL injection, broken authentication, cross-site scripting, and business logic flaws.
• Mobile Application Penetration Testing Security testing for iOS and Android applications, covering insecure data storage, weak authentication, unprotected API endpoints, and mobile-specific attack vectors using static and dynamic analysis.
• Cloud Security Testing Penetration testing for AWS, Azure, and GCP cloud environments, assessing misconfigurations, access controls, exposed storage, and data residency compliance.
• External Infrastructure Penetration Testing Assessment of perimeter defences, internet-facing assets, public-facing services, VPNs, and booking systems to identify external entry points.
• Internal Infrastructure Penetration Testing Testing of internal network segmentation, lateral movement, privilege escalation, and insider threat scenarios within corporate environments.
• LLM and AI Red Teaming and Penetration Testing Red team engagement specifically targeting LLM and AI applications, evaluating model safety, prompt injection resistance, data leakage, and AI-specific attack surfaces.
• Physical Penetration Testing Onsite security assessment evaluating physical security controls, access barriers, badge systems, and personnel procedures to identify physical entry points.
• Social Engineering Testing In-depth, highly-targeted phishing and social engineering campaigns to assess employee susceptibility, awareness, and organisational resilience against human-targeted attacks.
• Phishing Simulation Phishing testing and awareness campaigns that simulate real-world phishing attempts to evaluate and improve staff security awareness.
• Healthcare Penetration Testing CREST-accredited penetration testing tailored for healthcare environments, covering medical systems, clinical applications, connected devices (IoMT), EHR integrations, and compliance with HIPAA, GDPR, NHS/DSPT, and NIS2 frameworks.
• Scan Asset discovery and automated vulnerability scanning service available on a subscription basis (daily, weekly, or quarterly intervals). Clients enable scanning on specific targets via the Target Management interface and can initiate on-demand scanning at any time.
• Radar Open-source intelligence (OSINT) gathering, active and passive scanning service that searches databases of open-source data and performs passive checks on client assets to identify potential threats. Identified threats are presented with expert recommendations.

Quantifiable outcome

• Up to 95% reduction in vulnerability management time
• +5 more outcomes

Named customers17 records

Segments8 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration1 record

AI capability1 record

Feature6 records

Scale indicators6 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Pentera: AI-driven automated security validation platform offering continuous pentest-style testing. Directly comparable to OnSecurity's AI-augmented pentesting value proposition, though Pentera is more product-led and less reliant on manual CREST-accredited human testers.
• Bishop Fox: US-headquartered offensive security firm combining consulting-led pentesting with proprietary platform tooling (e.g., Cosmos). Comparable as an AI-era pentest provider mixing human expertise with platform automation targeting enterprise CISOs.
• HackerOne: Bug-bounty and pentest-as-a-service platform with global hacker network. Competes for the same penetration testing budget, with overlapping positioning in continuous testing, vulnerability disclosure, and platform-based delivery.
• Cobalt: Pentest-as-a-service platform connecting customers to a vetted tester network via a managed platform experience. Closely comparable to OnSecurity's portal-based subscription model with on-demand scoping and reporting.
• Pentest People: UK-based CREST-accredited penetration testing firm with a platform-driven delivery model. Highly comparable given similar UK presence, CREST accreditation, subscription/platform packaging, and target SMB-to-enterprise mix.
• Horizon3.ai: Autonomous pentest platform using AI to continuously identify and validate exploitable attack paths. Closely comparable as an AI-native pentest platform challenger to OnSecurity's AI-augmented positioning.
• Cyberis: UK-based cybersecurity services firm specialising in penetration testing and threat intelligence. Comparable as a CREST-aligned pentest services competitor focused on UK and European regulated customers.

Broad incumbents

• NCC Group: Large UK-listed cybersecurity services and consulting firm with a substantial CREST-accredited pentest practice. A broader incumbent competitor for enterprise and regulated-vertical pentest mandates that OnSecurity also targets.
• Outpost24: European-headquartered vulnerability management and threat intelligence platform. Comparable as a Scan/Radar-style continuous vulnerability scanning and OSINT/threat intelligence competitor with overlapping subscription packaging.
• Rapid7: Public cybersecurity platform with Metasploit and managed testing services. A broader incumbent that competes for pentest and vulnerability management budget, particularly with mid-market and enterprise buyers.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/WeAreOnSecurity
• LinkedInlinkedin.com/company/onsecurity

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds2 records

Investors2 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about OnSecurity