Ethiack
Coimbra agentic AI pentesting engine that maps attack surface and proves exploitability continuously
Quick Overview
| Company | Ethiack, S.A. |
|---|---|
| Category | Bug Bounty Platforms |
| Headquarters | Coimbra, Portugal |
| Founded | Not stated |
| EU Presence | Yes - Portugal (EU) |
| Data Location | Not stated on the pages checked |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | No |
| Main Features | Agentic AI pentesting (Hackian), attack surface management, adversarial exposure validation, vulnerability and risk exposure management, on-demand pentesting by ethical hackers, API, compliance reports |
| Pricing | Pricing on request |
| Best For | Teams that want continuous automated pentesting with proof-of-exploit instead of a yearly snapshot |
| Replaces | HackerOne, Bugcrowd, point-in-time pentests |
Detailed Review
Ethiack's terms of service name Ethiack, S.A., a Portuguese company with registration number 516856146, and the privacy policy gives the registered office at the Instituto Pedro Nunes in Coimbra. Its services are listed as attack surface management, vulnerability and risk exposure management, continuous and on-demand security testing, and an API.
It is not a bounty marketplace: the engine, called Hackian, replaces scheduled pentests with autonomous testing, and the vendor says ethical hackers contribute on-demand testing.
Proof Instead of Scores
The home page says each confirmed risk comes with a proof-of-exploit and remediation guidance, and that testing triggers on code pushes, infrastructure changes and new knowledge.
Findings are described as validated for exploitability, which targets the false-positive load that scanners create.
Attack Surface Coverage
The platform maps internal, external and third-party assets, including unknown subdomains and APIs, and covers mobile, IoT, OT and cloud assets according to the vendor.
Live reports for NIS2, DORA, SOC 2, ISO 27001 and PCI are listed as outputs.
Customers Named by the Vendor
Case studies on the site name ANA Aeroportos, Bluepharma and Universidade do Porto. The figures quoted there (for example a 650% ROI) are vendor claims from its own case study and were not checked independently.
Limitations to Consider
Ethiack is a testing engine, not a platform where you invite outside researchers, so it replaces a bounty only where continuous automated coverage is enough. Prices are not published. The privacy policy page checked is dated 2022 and the pages do not state a hosting location. The performance numbers on the home page are vendor claims. For a crowd of researchers see YesWeHack or Yogosha.
Who Should Use Ethiack
Portuguese and European security teams with NIS2 or DORA reporting duties that want automated, repeatable pentesting with evidence.
Pros and Cons
Pros
- Proof-of-exploit attached to confirmed findings
- Event-triggered continuous testing
- Attack surface mapping with third-party assets
- Compliance reports for NIS2 and DORA
- Portuguese S.A. with registration number published
Cons
- No researcher crowd or reward grid
- No prices published
- Hosting location not stated
- Performance figures are vendor claims
Alternatives to Ethiack
Other European bug bounty platforms worth comparing before you decide:
YesWeHack
France · Paris bug bounty and exposure platform hosted in an EU private cloud
Intigriti
Belgium · Antwerp bug bounty platform with managed VDP and PTaaS
Yogosha
France · Vetted researcher community for pentests and private bounties
Detectify
Sweden · Stockholm attack-surface and application scanner with ethical-hacker payloads
See all European bug bounty platforms or compare them directly against HackerOne on our alternatives page.
Frequently Asked Questions
No. It is an agentic AI pentesting and attack surface management platform; it does not run a public reward program for outside researchers.
The terms of service name Ethiack, S.A., incorporated in Portugal, and the privacy policy gives a registered office in Coimbra.
The vendor says each confirmed risk comes with a proof-of-exploit and remediation guidance.