Equixly
Florence-based API penetration testing built on AI agents that chain calls to find broken authorization and other business-logic flaws
Quick Overview
| Company | Equixly S.r.l. |
|---|---|
| Category | API Security Platforms |
| Headquarters | Florence, Italy |
| Founded | Not stated |
| EU Presence | Yes - Italy (EU) |
| Data Location | Not stated on the pages checked |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | Not stated |
| Main Features | Agentic AI penetration testing, API discovery and inventory, data classification, dependency mapping, CI/CD triggers, OWASP API Top 10 coverage, remediation guidance |
| Pricing | Single penetration test €4,999; continuous platform by quote |
| Best For | Security teams that want attack results on APIs without waiting for a pentest slot |
| Replaces | Traceable, Salt Security, manual API pentests |
Detailed Review
Equixly replaces the scheduled API pentest with software agents that attack your endpoints repeatedly. Its pitch is that a point-in-time report is out of date a week later, because APIs change more often than a pentest calendar does.
The contracting company is Equixly S.r.l. in Florence, Italy, named as data controller in its privacy policy, and the site footer shows an Italian VAT number and the Cybersecurity Made in Europe mark.
What the agents try
The vendor says its agents chain API calls and workflow steps to expose authorization bypasses, BOLA and IDOR cases and multi-step exploit paths that a single-request scanner cannot model. It also tests for injection flaws, authentication weaknesses and misconfigurations.
Findings are meant to be validated by actual exploitation, which the vendor presents as the way to cut false positives.
Inventory before attack
A second module keeps a live inventory of APIs, flags undocumented endpoints, classifies personal data in responses and maps dependencies between services. The attack agents use that map as context.
A price you can read
The pricing page lists one fixed offer: a penetration test with results in two days, black-box and grey-box, for €4,999. The continuous platform is quoted, aimed at organisations with mature API-driven architectures.
Limitations to Consider
There is no free tier or self-serve trial on the pages checked, and the continuous platform has no public price. Deployment region and on-premise options are not stated. The product tests and maps APIs but does not sit in the traffic path, so it does not block attacks; pair it with a gateway or the contract firewall from 42Crunch.
Who Should Use Equixly
Companies with many internal and partner APIs that want recurring, exploit-validated testing and a single quote for a one-off test.
Pros and Cons
Pros
- Targets BOLA, IDOR and multi-step logic flaws
- Published single-test price
- Covers REST, GraphQL and single-page apps
- Triggerable from CI/CD
- ISO 27001 certified according to its footer
Cons
- No runtime protection
- No free trial seen on the pages checked
- Continuous plan is priced on request
- Hosting location not stated
Alternatives to Equixly
Other European api security platforms worth comparing before you decide:
42Crunch
United Kingdom · Contract-driven API audit, scan and runtime protection from OpenAPI files
Escape
France · Business-logic DAST for REST and GraphQL APIs from Paris
AppCheck
United Kingdom · Scanner with API-specific fuzzing, request signing and OAuth support
Aikido Security
Belgium · Developer security suite with an API scanner and shadow API discovery
See all European api security platforms or compare them directly against Traceable on our alternatives page.
Frequently Asked Questions
According to the vendor, its agents adapt to application behaviour and chain calls across workflows, while rule-based DAST sends fixed payloads per request.
€4,999 per test according to its pricing page, with results in two days and a full audit report.
Yes, the vendor says autonomous tests can be triggered from CI/CD so new releases are attacked before production.