Direct answers, no sales spin

A /24 subnet has 256 possible addresses. "Up to 500 IP-assessments per month" refers to cumulative assessment cycles across that subnet — i.e., re-scans and repeat testing cycles count toward the total, not 500 unique external IPs. In practice this supports roughly weekly full-subnet re-assessment cycles within a month. If your engagement needs a different cadence, we'll scope it explicitly in your agreement.

Both. Automated tooling handles discovery and initial exploitation at scale, but every finding is reviewed by our OSCP/CISSP/CISM-certified security team before it reaches you. High-impact exploits require human approval before execution — we don't let automation run unchecked against production systems.

Yes, by design. Every engagement runs inside a signed authorization agreement with explicit scoping, exclusion lists for sensitive/critical systems, configurable maintenance windows, and a full audit trail. See our Compliance & Safety page for the full policy.

A traditional pentest is a single point-in-time snapshot — you get a report once a year and rarely get re-tested after remediation. Our continuous model re-assesses on a schedule you control, automatically re-tests every fix, and tracks your risk score improving cycle over cycle. See the Purple Team page for the full comparison.

Our organizational controls are aligned with ISO/IEC 27001:2022 and SOC 2 Type II frameworks. Individual certifications (OSCP, CISSP, CISM, and others) are held by members of our security team personally — MatrixIT as an organization is not itself certified by OffSec, ISACA, or (ISC)². See Compliance for full detail.

One /24 subnet under continuous assessment, up to 500 IP-assessment cycles per month, a 12-month term, automated + human-reviewed findings, full remediation guidance, and automatic re-testing after each fix. See Pricing for the complete breakdown and Enterprise options.

Yes — see our Sample Report page. It shows real finding types, severity tagging, and remediation status from actual engagements (fully anonymized).