Tool profile
Equixly: cost, fit and limits
Equixly is an offensive security platform made by Equixly, headquartered in Verona, Italy, whose AI Hacker runs autonomous penetration tests and AI red teaming against web applications, APIs, GenAI systems and MCP servers for security teams.
What to know first
Equixly describes four cooperating agents, a proof-of-exploit gate and models it owns instead of renting from a third party. Pricing is by quote, and the page says cost scales with what you test, not with each test run. The site shows ISO 27001 and SOC 2 compliance badges. A buyer should ask for a sample report to see how findings are evidenced.
Equixly at a glance
| Maker | Equixly, Italy |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | No |
| Category | Best AI API Security Software in 2026, rank 4 of 10 |
| Website | equixly.com |
Who Equixly is best for
Teams replacing yearly pentests
Always-on validation is contrasted on the site with point-in-time tests that leave gaps between engagements, which suits teams shipping weekly.
Buyers wary of third-party AI
The site says Equixly owns its models and test harness, so testing does not depend on another provider's policies, availability or pricing.
European and UK security teams
A head office in Verona and an office in London, plus a stated regulated EU data residency claim, simplify procurement for European buyers.
Equixly plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Autonomous penetration testing | Quote only | Continuous AI-driven testing of a single application or an entire portfolio, priced by what is tested rather than by number of runs. |
| AI red teaming | Quote only | Adversarial testing of GenAI systems and MCP servers, listed beside web and API testing on the platform page. |
| Partner programs | Not shown on the pages read | Reseller, MSSP and technology integration programs are offered, with no terms or fees on the pages we opened. |
Checked November 2026.
What Equixly does
- Discovery agent
- A Discovery agent maps endpoints and workflows first, so the attack plan starts from what the application actually exposes instead of a fixed checklist. It is the first of four stages.
- Attacker agent
- An Attacker agent crafts and refines payloads based on responses, which lets it follow a thread across several requests rather than firing a single signature.
- Evaluator gate
- An Evaluator agent judges whether an attack succeeded, and findings are reported only after it reproduces them. The site's example drops an unproven data exposure.
- Attack-path chaining
- The example on the site combines two minor issues into a critical account takeover, showing why chained findings can matter more than isolated ones. Chaining is shown in one example only.
- CI/CD testing
- A dedicated platform page covers testing in pipelines, and documentation sits on docs.equixly.com. Pipeline limits and run times are not listed on the pages we opened, so test them in a trial.
How Equixly handles your data
The site claims data stays within a defined security boundary with regulated EU data residency, rather than passing through opaque third-party AI chains, and that Equixly runs the infrastructure and models itself. It shows ISO 27001 and SOC 2 compliance badges. The contact page gives a head office in Verona and a London office, and the home page shows an Italian VAT number. The pages we opened did not name a hosting provider, retention periods or training practice beyond that claim.
Where Equixly falls short in practice
- No price or trial. Pricing is requested through a form and there is no self-serve start, so a team cannot run a test on a staging API without talking to sales first.
- Claims without regions. EU residency is stated, but no hosting provider, data center country or retention period appears. Security reviewers will need the data processing terms in writing.
- Agent logic is not inspectable. The multi-agent design is described in prose and one example. Buyers cannot see detection rates, so run a trial on an API with known flaws before signing.
Works with
Alternatives to Equixly
Equixly: common questions
How does Equixly decide a finding is real?
A separate Evaluator agent tries to reproduce each suspected issue, and only reproduced findings are reported. The site gives an example in which an unproven data exposure is dropped. Ask for a sample report to see the evidence attached to each finding.
Does Equixly use third-party AI models?
The site says Equixly owns its models and test harness and runs the infrastructure, presenting this as independence from third-party model policies and availability. It does not name the models, so ask which are trained in-house and what customer data they see.
Where is Equixly based?
The contact page states a head office in Verona, Italy, and an office in London. The home page shows an Italian VAT number. It does not list a legal seat, so ask for the contracting entity before signing a data processing agreement.
Which compliance badges does Equixly show?
The site shows ISO 27001 and SOC 2 compliance badges. The pages do not include report dates or scope, so request the certificate or report under NDA before treating the badges as evidence in a vendor review. Ask for dates and scope.
What can Equixly test besides APIs?
The platform page lists web applications, GenAI systems and MCP servers beside APIs, and it offers AI red teaming. Ask which test types are included in your quote, because the page presents them together without a split. Ask for a scope list.