Questions, answered
What teams ask before they hand us an org. If yours is not here, raise it on the demo call.
Frequently asked questions
How is Kairo different from a traditional pentest?
A pentest is a point-in-time engagement run by humans over a few weeks. Kairo runs continuously with autonomous agents, retesting on every change and surfacing new exposures the moment they appear.
Do you test against our production environment?
Simulations never run against production. They run against a shadow environment, a running copy of your application with live-shaped data, and every action is logged so you can audit exactly what was tested. The one thing that touches your live hosts is external attack-surface discovery, which is non-invasive and stays inside the scope you define.
What can Kairo test?
Web applications, APIs, cloud and infrastructure, external attack surface, secrets and supply chain, and AI/LLM systems, including prompt injection and agent data leakage.
How quickly do we see results?
Setup takes minutes with scoped, read-safe access. Most teams get their first verified findings within days rather than the quarters a traditional engagement requires.
Will we be buried in false positives?
No. Every finding is verified and reproduced end-to-end before it reaches you, so your team spends time on real risk, not triaging noise.
Does Kairo read my code?
For pull request reviews, yes. The PR diff is sent to the model, and only after the workspace owner consents when installing the GitHub App. Kairo never trains on client code without a separate, explicit opt-in.
Can I cancel?
Any time, from the billing page. Your current billing period stays active until it ends, and no further charges are made.