Launching Pentest.fyi

I launched Pentest.fyi this week. It is a directory for finding penetration testing companies around the world, with filters for location, speciality, company size, and certifications.

Why build it

The idea came from two places.

In my conversations with CTOs about security questionnaires, a question keeps coming up: “Can anyone recommend a pentest company?” or “Where do I even find one?” There is no single place to search and compare. I saw an opportunity to build something useful that would also attract people who might need help with security questionnaires, creating a marketing channel for Response Hub.

The second reason was curiosity about a tool called EXA. EXA has a feature called Websets that lets you run natural language searches and get back structured data. I wanted to see if I could use it programmatically to build a comprehensive dataset of pentest companies.

How it works

I wrote a set of scripts that generate queries and pull data from EXA’s Websets API. Each query targets a specific combination of location and speciality, and EXA returns structured records with company names, websites, descriptions, and metadata.

The result is about 7,500 records of pentest companies. The scripts handle deduplication, data cleaning, and enrichment before the records go into the directory.

Programmatic SEO

Pentest.fyi is partly a programmatic SEO experiment. Each company has its own page, and the filtered views (by country, by speciality, by certification) create thousands of indexable pages. The early traffic numbers look promising.

It also gets me thinking about building similar directories in other verticals. The pattern of using EXA to programmatically collect structured data, then presenting it in a searchable directory, is repeatable. The hard part is finding the right niche where the data is scattered and people are actively searching.