Development had become continuous, so security needed to catch up. Businesses used to run a security test once a year, every six months, or quarter. But they were pushing out code every week. In between, it was like the Wild West. Astra was the first company to make security continuous. 

Pentesting felt like it was stuck in the 90s. Manual pentests were very service-driven in nature. You’d call a firm, answer a hundred questions, most of them irrelevant, and eventually receive a 400-page PDF report with the issues they found. We turned this experience into a product: a vulnerability management dashboard that shows where the issue is, how to reproduce it, and how to fix it.

We were consumed with what we were building. That’s where Paddle came in. With our old Merchant of Record, searching orders was a struggle, there were few APIs, and no in-app checkout. We looked at Stripe, but we’d have had to stitch on a tax tool and track US state thresholds ourselves. We were busy building a new product and a new go-to-market motion - we didn’t want to figure out taxes too. 

Customers don’t care about consumption: they want an outcome. We have always used outcome-based pricing. The moment AI arrives, everyone moves to consumption pricing: you use X tokens, so you pay Y plus Z. We charge per application, per pen test, and it’s on our website. No surprises or increases. That has been our approach from day one.

AI feels like the biggest change in a decade. Security is very contextual; testing an ecommerce app is nothing like testing a payment gateway or SaaS product. Those business-logic differences always need humans. But now with AI, we can build those test cases on the fly and do even deeper security testing. Since we launched autonomous pentesting, work that took us days now takes hours. Attackers have AI, so defenders need it too.

The biggest win for us is that payments have never been a challenge. For four years Paddle has run in the background without needing our attention. When a failed payment did come up, we talked to the team and got a resolution quickly. Payments have never become a problem big enough to pull us away from the product.