About · disclosure
Who publishes this and what we sell
This catalogue is published by Lennart Lopin, who runs Decima Systems. Decima Systems is our editorial pick for AI-driven application and API testing, with human review of findings. We run it, and it is new (2026, pilot stage). Every other tool here is described only from its maker’s own pages, and no vendor pays to appear.
The publisher
Lennart Lopin is CTO and co-founder of Byte Federal and holds the CISSP, CCSP and CSSLP certifications. He wroteNo Human in the Loop: Cybersecurity in the Autonomous AI Age, and in 2026 he founded Decima Systems to build AI-assisted application testing with human review of findings.
Many lists of AI pentesting tools are published by companies that sell one. So is this one, which is why it says so on every page and keeps its own product out of every ordered list.
The editorial pick
Decima Systems
Decima Systems is our editorial pick for AI-driven application and API testing, with human review of findings. We run it, and it is new (2026, pilot stage).
AI-assisted security testing of applications and APIs. Its design puts an AI model agent in an isolated, Kali-style environment, with a person reviewing findings before they are reported.
- Stage
- Pilot stage: pilot enquiries open
- Founded
- 2026
- Starter (early access)
- $99 per month: one target, one AI-run assessment a month, an automated retest after a fix, and human review of confirmed critical and high findings. An early-access price while the continuous service is finalised
- Pilot
- $3,000 for one scoped application or API assessment, with reviewed findings and one agreed retest
- Adversary standing service
- $1,499 per month: up to 15 registered targets; daily report updates are in development
- Sovereign
- Bespoke annual engagement inside your environment, a planned option
- Sample report
- 38-page PDF. A fictional assessment with synthetic data; no live test was performed.
Indicative prices exactly as published on decima.systems (re-read before this deploy); excludes applicable US sales tax. Checked November 8, 2026.
What is real today, and what is not yet
Decima’s own site lists these as available now:
- Account setup, engagement planning and a downloadable PDF budget proposal
- Manual DNS verification of domain control
- A clearly labelled demo console
- A 38-page illustrative assessment report
And these as in development: automated assessment execution, daily customer reporting, digital signing. AI agent and LLM assessment is listed as a proposed pilot focus, scoped with the pilot.
How the pick is handled
- It is a judgment by the owner of the firm being picked, not a measurement. It is labelled Editorial pick · we run it wherever it appears.
- Decima is kept out of every ordered list and table on this site. It appears in its own box.
- It is a testing service in its pilot stage, not software you install, which is one more reason it sits apart from the tools.
- Its entry follows the same rule as the rest: facts from its public site, with the date checked. Where that site says pilot, planned or in development, so does this one.
Same owner, one other site
Lennart also publishes pentestingfirms.com, which compares penetration testing firms: for when you want a firm to run the test for you rather than a tool to run yourself. The two sites share an owner and a disclosure, and nothing else: separate data, separate pages.
How the site makes money
No vendor pays to be listed, and there are no affiliate links. Requests sent through the quote formgo to Decima Systems, and that is the honest reason the site exists. If paid placements are ever added, they will be labelled “Sponsored” and kept out of every ordered list.
Corrections and contact: engage@decima.systems(subject “aipentestingtools.com”). How entries are chosen and corrected is on the methodology page.
Sources for this page
- Decima Systems: services, pricing and FAQ — Decima’s stage, prices and what is available today.
- Decima Systems: method — How Decima’s testing is designed (model agent, isolated environment, review).
- Decima Systems: sample report — That the sample report is synthetic and no live assessment was performed.
Each tool’s own sources are linked from its entry. How tools are chosen and ordered, and how to correct an entry: methodology.
Cite this page
AI Pentesting Tools. “Who publishes AI Pentesting Tools, and our disclosure.” Updated November 8, 2026. https://aipentestingtools.com/about/