XBOW fits when
You want autonomous testing of internet-facing web applications and their APIs, priced by usage, with the option to buy through a cloud marketplace.
ShieldProbe and XBOW
XBOW and ShieldProbe: what each tests, and what you get back.
Both test web applications and their APIs. ShieldProbe Assess also covers networks and servers, internal or external, and a named consultant approves each pentest finding before you see it.
How XBOW and ShieldProbe compare
XBOW runs autonomous tests of web applications and their APIs. Here is how that lines up with a ShieldProbe engagement.
Scroll the table sideways to compare both options. You can also focus it and use the arrow keys.
| Compared on | XBOW | ShieldProbe |
|---|---|---|
| What it tests | Web applications and their APIs, logged in or not, in production or staging. XBOW’s documentation says assets not reachable from the internet may be incompatible, and that it does not test APIs without an interactive web application. Other asset types are on its roadmap. | Web apps, APIs (REST, GraphQL, SOAP), networks and servers, internal or external. Black-box for every target; grey-box with your test accounts for web apps and APIs. |
| Findings and review | Each finding includes the chained attack path, the working exploit and a full log. Independent validators confirm each exploit is reproducible, and XBOW states that findings are reviewed before you see them, without saying who reviews them. | AI authors each finding and a named consultant approves it before you can see it. Every finding carries the request, response and impact, so your team can reproduce it. |
| Fixes and retests | Findings carry remediation guidance and can be sent to Jira, GitHub issues or coding agents. A retest replays the original exploit, then tries further techniques to check the fix cannot be bypassed. | Retests of confirmed findings for 12 months under your engagement terms. Fix drafts the code change in VS Code or Visual Studio (beta) for your developers to review. |
| Application protection | None described in XBOW’s product pages. | Defend, sold separately, adds protection rules for supported findings inside your Node.js app. It starts in log-only mode and blocks only once you turn enforcement on. Ownership flaws such as IDOR are logged, never blocked: they need the code fix. |
| How it runs | An autonomous platform with guardrails: a safety judge reviews each action before it runs, with rate limits and testing windows. Targets generally need to be reachable from the internet, and you may need to allowlist XBOW’s IP addresses. | A scoped pentest run from our own attack infrastructure. External targets need nothing installed; internal targets are reached through a small connector that needs no admin rights. The report arrives in 48 hours for agreed scope once access is ready. |
| Pricing | Usage-based pricing scoped to the environment, also sold through the AWS, Google, Oracle and Microsoft marketplaces. | Quoted per assessment from the agreed scope, before testing starts. Defend is sold separately. |
Plan a side-by-side test
Use the same targets and test accounts you gave the other tool. We agree scope and access with you before testing starts.
Which fits your team
ShieldProbe fits when
You also need internal applications, networks or servers tested, want a named consultant to approve every finding, or want protection inside your app while the fix is built.
What happens after the report
Each module takes a finding one step further.
Assess
A pentest of your web apps, APIs, networks and servers. A named consultant approves every finding, and each one comes with evidence your team can reproduce.
Explore AssessDefend
Protection for supported findings inside your Node.js app, sold separately. It starts in log-only mode and blocks only when you turn enforcement on. Ownership flaws are logged, never blocked.
Explore DefendFix
A code change drafted from the actual attack, in VS Code or Visual Studio (beta). Your developers review it and raise the pull request.
Explore FixContinuous
Developer preview. Selected tests run on the repository events you enable, so each change is tested as it ships.
Explore ContinuousCommon questions
Is XBOW limited to web applications?
Its documentation covers web applications and their APIs, with other asset types on its roadmap.
Can we run ShieldProbe alongside XBOW?
Yes. Both test web applications and APIs, so you can run them on the same targets and compare the findings. ShieldProbe Assess also covers networks and servers, internal or external.
Who reviews the findings?
XBOW states that independent validators confirm each exploit and that findings are reviewed before you see them. In ShieldProbe Assess, a named consultant approves each finding before you can see it, and the platform will not release a finding without that approval.
Do we install anything?
Not for external targets. Internal targets are reached through our connector or another access path agreed during scoping. Defend, if you add it, runs as an SDK in your Node.js application.
Sources
Details about other products and standards come from the public sources below, reviewed on 20 October 2026 unless dated. If anything has changed, tell us and we will correct it.
- XBOW platform: scope, validators, guardrails, retests and integrations (reviewed 27 October 2026)
- XBOW documentation: supported asset types (reviewed 27 October 2026)
- XBOW documentation: choosing an asset to test (reviewed 27 October 2026)
- XBOW documentation: comprehensive and retest assessments (reviewed 27 October 2026)
- XBOW pricing: usage-based model and marketplaces (reviewed 27 October 2026)