Casik runs an automated penetration test against your site and tells you what an attacker could exploit, how serious it is, and how to fix it. Your first scan is free. After that, each vulnerability our AI finds costs $1.70 on average.
We only test websites you can prove you own. That keeps scans legal for you and keeps Casik from being used against someone else's site.
Use your work email. We send a one-time sign-in link, so there is no password to manage.
Connect the Cloudflare account that runs your DNS, or the Google Search Console property for your domain. It takes under a minute.
Casik crawls your site, probes it like an attacker would, and ranks every confirmed issue by CVSS score with clear fix steps.
A pen test without permission counts as unauthorized access. Our verification step protects you, your customers, and every other site on the internet.
Computer Fraud and Abuse Act (CFAA) treats unauthorized probing of a computer system as a federal offense.
Computer Misuse Act 1990 covers unauthorized access, including automated attacks.
Directive 2013/40/EU requires member states to criminalize illegal access to information systems.
No verified ownership, no scan. Verification is re-checked before every run.
Scans run on AI agents that use tokens. The free plan covers a quick check. Buy prepaid credits with PayPal when you want a deeper test and the full list of findings.
Casik throttles its requests and avoids destructive payloads. It does not delete data or submit real orders. We still suggest running your first scan outside peak hours.
Both prove that you control the domain. We ask for read-only access and use it only to confirm ownership. You can revoke it at any time.
If the scan finds more than three issues, we show you the three most severe ones. Buy credits to unlock the full report.
You pay only for the tokens the scan uses. On average, each vulnerability our AI finds costs $1.70. A deep scan of a typical business site uses about 15 credits, or $8 to $11.
Casik catches the common, high-impact issues that attackers find with automated tools. For compliance audits or complex apps, use it alongside a manual test.
Reports belong to your account and are visible only to you. You can delete a report and its raw data from your dashboard.