Point-in-time testing on an always-on surface
Traditional pentesting run 5–10+ weeks per engagement at $15K–$50K. A 2-week development sprint can introduce changes faster than a traditional point-in-time engagement can be scheduled and completed.
Continuous security validation for financial institutions
We work with your security team. Not around it.
Vana handles the continuous, high-volume layer of web and API testing that consumes your AppSec team's capacity — so your senior people spend their time on architecture, triage and remediation strategy, not repetitive scope. Canadian-headquartered, with an optional certified human review layer for board- and regulator-grade sign-off.
Start with a 20-minute call — we'll review your application scope and enterprise requirements, and confirm the proposed service and pricing after the call.
The problem
Financial institutions carry the highest breach costs — and need testing that keeps pace with change.
Bill C-8 received Royal Assent in June 2026 and enacted the Critical Cyber Systems Protection Act, which creates cybersecurity program, incident-reporting and supply-chain-risk obligations for designated operators in vital sectors, including banking and clearing and settlement systems. The Act is law now; the government hasn't yet issued the designation orders but once designation orders apply, covered operators will have 90 days to establish their cybersecurity programs.
Meanwhile, incumbent options are built for a different era: manual pentest firms run 5–10+ weeks per engagement and $15K–$50K, and the enterprise autonomous platforms in this category are built around annual contracts, not the continuous validation that a bank's always-on, internet-facing surface actually needs.
Your team is already stretched managing alert fatigue and a backlog of untested assets. Adding another slow, expensive vendor relationship doesn't solve that.
Portfolio sprawl no annual scope can cover
Hundreds of web apps, internal portals, partner integrations and open banking APIs across retail, wealth, capital markets and acquired entities. Scope negotiation alone eats a quarter.
Senior AppSec capacity burned on repetitive scope
Your teams are re-testing the same authenticated flows instead of fixing the systemic issues underneath them.
Evidence demanded by more regulators every year
DORA, PCI DSS and NYDFS require rat minimum annual pentesting. FFIEC/OCC expect regular testing - not a one-of PDF.
Cross-border data and vendor scrutiny
North American and European entities under one program, each with its own residency, subcontractor and concentration-risk expectations.
Complexity, not price, is the blocker
SSO, step-up auth, transaction signing, multi-tenant entitlements, legacy middleware. Most tools quietly skip exactly the surface that matters.
Meet Vana
The only in-house trained AI-autonomous pentester on the market.
Not a scanner. Not a wrapper around an existing tool. Built and trained in-house, Vana attacks your live web applications and APIs the way a real intruder would — at 95%+ accuracy, continuously, rather than once a year.
Autonomous, not a scanner
Vana reasons about your application: enumerates, chains findings, escalates privileges and proves impact the way a human intruder would.
Deep authenticated coverage
SSO/SAML/OIDC, MFA and step-up flows, role-based entitlements, multi-tenant boundaries, GraphQL and REST business logic.
95%+ accuracy, validated impact
More than any manual or typical AI pentester. Each finding ships with evidence, so triage isn't a second job.
Sovereignty matters here
InfiltrateIQ is Canadian-headquartered, in a market where 82% of Canadian buyers weigh vendor country of origin and 56% are actively reconsidering US-based providers. Canada's Cyber Centre joined international partners in publishing guidance for the secure development and adoption of agency AI systems.
Augmentation, not replacement
We're never positioned as a substitute for your internal security function. Vana absorbs the repetitive, continuous testing layer; your team stays focused on what requires human judgment.
Built for complexity
If it authenticates, branches or settles money, Vana can test it.
Price isn't the constraint for an institution at this scale — handling the environment is. Vana is designed for the surfaces that defeat conventional automation.
SSO, SAML, OIDC and step-up authentication
Multi-tenant and entitlement-based access boundaries
Open banking and partner APIs (REST + GraphQL)
Transaction and payment business logic abuse
Legacy middleware and internal portals
Acquired-entity estates and shadow applications
Pre-prod, staging and production change windows
Portfolio-wide scheduling across regions and entities
Jira / ServiceNow workflow integration
Regulatory fit
One continuous evidence trail across North America and Europe.
Reporting is OWASP-aligned and can be mapped to relevant control frameworks with optional review by a qualified human pentester where additional assurance is needed.
Canada
- CCSPA (Bill C-8, Royal Assent June 2026) — documented cyber program, 72-hour incident reporting, supply-chain risk for designated banking and clearing/settlement operators
- OSFI B-13 technology and cyber risk expectations
United States
- NYDFS Part 500 annual penetration testing and continuous monitoring
- FFIEC / OCC examination expectations and PCI DSS 4.0 (11.4)
Europe & UK
- DORA threat-led testing, ICT third-party register and incident reporting. DORA resilience testing and incident reporting, with threat-led penetration testing generally required at least every three years for entities selected by their competent authority
- DORA resilience testing and incident reporting, with thread-led penetration testing generally required at least every 3 years for entities selected by their competent authority.
- PSD2 and open-banking API security, GDPR safeguards, and lawful international data-transfer mechanisms.
Pricing
Start with a 20-minute call. Scale to continuous coverage.
Pricing that fits an operator's scale and ongoing exposure — not a point-in-time engagement. Start with a 20-minute call, then scale to continuous coverage across the portfolio with optional certified human review.
20-MIN CALL
Start with a 20-minute call
$0
Speak with our team to review your application scope and enterprise requirements. Enterprise enquiries do not receive a freemium account or self-service dashboard access. We will confirm the proposed service and pricing after the call.
CONTINUOUS COVERAGE
Vana Continuous
$2,000/ app / mo
VOLUME PRICING FOR ADDITIONAL APPSFixed monthly pricing per customer-facing web application, with volume-based pricing across your portfolio. Fits an operator's scale and ongoing exposure better than a point-in-time engagement.
OPTIONAL ADD-ON
Human-in-the-Loop Review
Custom Pricing
Certified human pentester review of findings, evidence packaging and sign-off for board updates, regulator conversations, or insurer requirements.
COMMON QUESTIONS, ANSWERED
Ask the hard ones.
Continuous coverage for the institutions that can least afford a gap.
Book a 20-minute call to review your application scope and enterprise requirements. We'll confirm the proposed service and pricing after the call.