vPenTest

Vonahi Security, now a Kaseya company, is a prominent player in the 'Offensive Security-as-a-Service' (OSaaS) market. Based in Atlanta, Georgia, the company was founded with the singular goal of automating the complex, manual task of network penetration testing. The company’s flagship product, vPenTest, serves as a SaaS platform that allows organizations to perform full-scale network assessments on-demand. Since its inception, Vonahi has focused heavily on the Managed Service Provider (MSP) channel, recognizing that small and medium-sized businesses (SMBs) were largely underserved by traditional cybersecurity firms. Following its acquisition by Kaseya in 2023, Vonahi has seen massive growth, expanding its reach to over 22,000 organizations globally. The company is positioned as a key innovator in the Gartner Hype Cycle for Security Operations, specifically within the automated penetration testing and red teaming category. Its strategic vision is centered on 'IT Complete,' Kaseya's philosophy of providing a unified, integrated, and cost-effective suite of all the tools a modern IT professional needs.

The company was founded in late 2017/early 2018 by Alton Johnson, a highly respected cybersecurity professional with over a decade of experience in ethical hacking. Before founding Vonahi, Johnson held leadership roles at several top-tier cybersecurity firms, including TraceSecurity and Accuvant (now Optiv). He is a prolific contributor to the security community, with a background in contributing to open-source projects like Kali Linux and Metasploit. The idea for vPenTest reportedly started on Reddit, where Johnson identified a massive market gap: many organizations wanted high-quality penetration tests but couldn't afford the $15,000+ price tags of traditional consulting firms. He envisioned a system that could 'clone' the brain of an elite hacker into software. Initially starting as a consulting-heavy business, Vonahi pivoted fully into a product-led company with the official launch of vPenTest in 2020, just as the demand for remote, automated security validation exploded during the pandemic.

Vonahi Security operated as a lean, high-growth startup before its major exit. Unlike many Silicon Valley tech companies that raise multiple venture capital rounds, Vonahi followed a more disciplined growth path focused on product-market fit within the MSP community. On April 25, 2023, during the Kaseya Connect Global conference, it was announced that Vonahi Security had been acquired by Kaseya. While the exact financial terms of the deal were not disclosed, the acquisition was a cornerstone of Kaseya's 'IT Complete 2.0' launch. This move provided Vonahi with the massive resources and global sales engine of Kaseya, which is backed by private equity giants like Insight Partners and TPG. Since the acquisition, the funding for vPenTest's development has been integrated into Kaseya’s broader R&D budget, allowing for rapid expansion into international markets and deeper integrations across the Kaseya product portfolio.

The primary offering is the vPenTest SaaS platform, which is divided into two main categories: Internal Network Penetration Testing and External Network Penetration Testing. The internal offering uses a deployable agent (Ubuntu-based VM) to simulate an attacker who has already breached the perimeter. It tests for misconfigured services, weak passwords, and insecure protocols that allow for lateral movement. The external offering scans and attempts to exploit an organization's internet-facing assets from the outside. Beyond the core testing engine, the platform offers specialized modules for Active Directory assessments and compliance-specific reporting for SOC 2, HIPAA, and PCI DSS. A recent addition is the 'Prospecting Test' for MSPs, which allows them to run a lightweight assessment for free or at a reduced cost to demonstrate risk to a prospect. All offerings include a multi-tenant dashboard and the ability to white-label the entire user experience and reporting suite.

Historically focused on the North American market, Vonahi Security has undergone significant global expansion following its acquisition by Kaseya. The company now leverages Kaseya's international infrastructure to serve customers across EMEA and APAC. To support European data residency requirements and serve the Middle East, vPenTest introduced a dedicated hosting region in Germany. This expansion has been supported by Kaseya's existing offices in key regions, including Dublin, London, and Sydney. In early 2025, Vonahi achieved CREST accreditation in the Australasia region, a significant milestone that validates its methodology for international markets. This global footprint allows them to serve large multi-national organizations that require consistent security testing across diverse geographic regions while maintaining compliance with local data protection laws like GDPR.

In the last 18 months, vPenTest has seen several major feature updates aimed at increasing executive visibility and operational efficiency. One of the most significant releases is the AI-Enhanced Executive Summary, which uses natural language processing to translate complex technical findings into a strategic narrative for CEOs and CISOs. Another major addition is the Automated Executive PowerPoint Presentation feature, which allows IT teams to instantly generate a slide deck from an assessment, saving hours of manual work. The platform has also expanded its technical capabilities with 'Grey Box' testing options, improved Active Directory attack simulations, and a more robust 'Activity Log' that helps security teams correlate vPenTest's actions with their own internal detection alerts. Integration with Kaseya IT Complete 2.0 has also brought 'one-click' workflows for remediation within Kaseya's RMM and PSA tools.

The culture at Vonahi is deeply rooted in the 'Made by Hackers' ethos. Despite being part of a large corporation like Kaseya, the Vonahi team maintains a strong identity as offensive security specialists. The company values transparency, automation, and continuous learning. Employees are encouraged to maintain their technical edge, with many team members holding certifications like OSCP, OSCE, and CISSP. The work environment is described as fast-paced and innovation-driven, with a focus on 'hacking' the traditional ways of doing things to find more efficient solutions. This culture extends to their marketing and community engagement, which is often direct, technical, and community-focused (as seen in their active engagement on platforms like Reddit and at events like Black Hat and DEF CON).

vPenTest has built a vibrant community, particularly among MSP owners and security professionals. They are highly active in the Kaseya Community portal, where users share best practices for interpreting results and selling security services. The 'Vonahi Insiders' group provides a forum for power users to provide feedback directly to the product team. Additionally, Vonahi is a fixture at major industry conferences like IT Nation, Kaseya Connect, and various regional MSP summits. They offer a robust set of certification programs for their partners, ensuring that MSPs can confidently explain the technical findings of a vPenTest report to their clients. The brand also maintains a strong presence on Reddit's /r/msp and other technical subreddits, where the founder Alton Johnson frequently engages in technical discussions with peers.