Opportunities › AI-driven penetration testing automation › Proposed app
Knocklist
Scoped AI security tests with evidence-backed reports your auditors can read
- Score
- 31
- confidence 42
- Evidence
- 1
- items on the page
- Rivals
- 0
- named in sources
- First version
- 45 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 2023
- Emerging market · AI estimate
ScreensConcept
Desktop app: Security teams define scopes, set rules, review plans and detailed evidence-backed reports—technical work requiring careful desk-based analysis and documentation. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
Scope
Ready for plan4 targets
About this appAI proposal
Knocklist runs scoped penetration tests with AI agents. You list the targets you own, set the rules of engagement, and approve a plan. The agents scan, probe and try to confirm each weakness, then write up what they found.
It is built for small security teams, independent testers and companies that need regular assessments but cannot book a consultant every quarter. Testers can hand it routine checks and keep their own time for hard problems.
Every finding keeps the steps and proof behind it, and nothing runs outside the approved scope. Reports export in formats for engineers, managers and auditors, so there is less rewriting after each test.
- Tagline
- Test your own doors often, and keep the proof.
- Voice
- DirectCarefulPlain
- Why this name
- Knocking is the first step of any test: trying a door to see if it opens. A list suggests scope and a clear order of work.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Scope and rules first
Add targets, proof of ownership, allowed techniques and test windows. Agents cannot act outside the scope you approved.
No member yet
A plan you approve
The agents draft an attack plan in plain steps. You edit or approve it before anything runs.
No member yet
Evidence on every finding
Each finding stores the commands, responses and a replay of how it was confirmed, so it can be checked.
No member yet
Report formats
Export the same results as an executive summary, an engineer ticket list or a full technical report.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#1F5C4APine · primary#F4F1EAPaper · surface#1B2420Ink · text#D9622BEmber · accent#3A6EA5Slate blue · data
Typography
Aa
Knocklist
ABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789
Test your own doors often, and keep the proof.
PricingAI proposal
The material gives no competitor prices. These tiers follow the monetization idea (by targets, frequency and team size) and are a starting point to test, not a benchmark.
Solo
$49 a month
- 1 target
- Monthly scheduled test
- All report formats
- Evidence replay
Team
$249 a month
- 10 targets
- Weekly scheduled tests
- Review queue for 5 testers
- Retests and audit log
Single test
$149 once
- 1 target, one run
- Plan approval
- Full technical report
Would you pay Solo · $49 a month?
Your answer tells PWAS which prices people accept. It changes no score.
No answers yet.
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- Shared outputs. Teams send reports and retest proofs to clients, auditors and engineers outside Knocklist. Each report carries a verifiable link to the evidence view.
- Do they become customers?
- Recipients are often security or compliance staff who could buy, but many only read once. Test whether report links lead to sign-ups from auditors and client security teams.
- First customers
- Independent penetration testers and small security consultancies (1 to 10 people) who write many similar reports and want routine checks automated.
- Where to reach them
- Security communities: Share sample reports and open walkthroughs in tester forums and chat groups, where open-source tools in this area draw interest.
- Direct outreach: Email boutique consultancies offering a free scoped test on their own lab target in exchange for feedback.
- Content: Publish write-ups of anonymized runs showing plans, proof and reports.
- First milestone
- Ten consultants run a real scoped test and five pay for a monthly plan within 60 days.
Why people already pay for this
- VerifiedGitHub repository gained 342 stars in 74 days
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Agent orchestrationLLM agent framework with a model gatewayPlans and runs multi-step tests and lets models be swapped.
- This app · Isolated test runnersSandboxed containers with a fixed security toolsetScans must run in contained workers with egress limited to approved targets.
RisksAI inference
- RegulatoryRunning attacks needs proof of authorization. Weak ownership checks could let someone point agents at a target they do not own, creating legal exposure.
- AIAgents may produce false positives or miss real flaws, or act outside intent. Findings need confirmation steps and human review.
- TechnicalHosting tooling that attacks targets means abuse risk, IP reputation problems and cloud provider policy limits on scanning.
- CommercialBuyers may not accept automated results for compliance. Some need a named human tester's signature, so reports may need a reviewer workflow.
- DataFindings and evidence contain sensitive details about customer weaknesses and must be stored and deleted with strict controls.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.