What stood out most was the technical depth. This wasn't a scanner report with a logo on it. Three testers worked through our platform using black-box and grey-box testing aligned with the OWASP Top 10 and OWASP Mobile Top 10.

We chose Stingrai's hybrid pentest, which pairs its testers with Snipe, its AI agent, on web apps. I liked getting both on one engagement: an AI agent built to hunt for complex web application flaws, and experienced testers applying their own judgment. I'd rather have that than choose between an automated tool and a purely manual test. The findings were specific to how our platform actually works, and our engineers could act on them.

The retest was just as rigorous. When we believed one fix was complete, their team retested it, told us it wasn't fully resolved, and explained exactly why. That's what you want from a pen tester, because a report is only useful if the tester is willing to send your work back.

Project management was just as strong. Findings and retest comments were easy to track through their portal, and Arafat and Omar stayed closely involved as we worked toward our deadline. When I asked for help late in the process, Arafat called me within minutes. Review collected by and hosted on G2.com.

Retesting took some back-and-forth close to our deadline, but that came from holding fixes to a high standard. I'd build in extra time for remediation and retesting. Review collected by and hosted on G2.com.