it definitely smoked the output of one of the $10K pentests we did
luminati on Hacker News
$50 vs $10K
In the thread “Securing a DoD contractor: Finding a multi-tenant authorization vulnerability”
Helped: Shannon provided reliable results and better baseline comparison.
Got in the way: Strix failed to complete; human pentest firms were mediocre.
… mediocre tests (of course yeah yeah the really good ones exist but even then they're not going to match the speed at which we are claude coding now). Tried a bunch of open source pentesters, including strix (though we never managed to get strix to actually complete.) this project called shannon was the only one that we managed to get working reliably and it definitely smoked the output of one of the $10K pentests we did, (we had just discovered shannon after we had gotten the pentest firm's report, so it gave us a good baseline comparison). caveat: this was white box and our pentest firm did greybox, but neverthless I was still very unimpressed by what I got from the pentest firm. …