Sentinel by Kayzen
Selling a security product to engineers: every claim had to be demonstrable.
- Year
- 2026
- Design & build
- 4 weeks
- Stack
- Next.js · React · TypeScript · Tailwind · Vercel
- Positioning
- Design
- Development
- Technical SEO
- Copywriting
- false positives claimedevery finding comes with a replayable PoC
- 0
- first meaningful renderstatic HTML served from the CDN
- < 1 s
- third-party domains called on load
- 0
What needed solving.
The background
Sentinel is Kayzen Web's autonomous penetration testing platform. AI agents do not analyse the code: they run the application, genuinely attempt exploitation and attach a replayable proof of concept to every vulnerability reported. The website is the product's commercial shop window and its gateway to a trial.
The constraint
The target audience — CISOs, lead developers, platform teams — is as impervious to marketing as it gets. A security website promising “total protection” loses its credibility in the first line. We needed a site that makes people want to try it without ever overpromising, and that stays readable for a non-technical manager comparing three providers.
The response
We reversed the usual hierarchy: proof before promise. The home page first shows an excerpt from a real report — the vulnerability, the exploit request, the proposed fix — and only then the sales pitch. The vocabulary stays that of the trade (PoC, false positive, CVSS) because readers know it, and watering it down would be taken for ignorance.
Every design choice, and the reason for it.
Dark by default, but not decorative
The dark theme is the sector's convention: security tools live in a terminal. Here it is functional — code blocks and report excerpts are the most-read elements on the page, and a dark background reduces glare during long reading sessions. Text/background contrast stays above 7:1, i.e. AAA level, not the AA minimum.
Proof as a component
A reusable “report excerpt” component: vulnerability header, CVSS severity, request, response, fix. It appears four times on the page, with different cases. It is the only animated element on the page — attention goes where the purchase decision is made.
No abstract illustrations
No padlocks, no shields, no wireframe globes. The visuals are screenshots of the tool. In this market, generic iconography is the most reliable sign that a product does not exist yet.
Controlled density
Line length capped at 68 characters and a fluid type scale using clamp(). The content is dense by nature; it is the layout that must compensate, not the reader.
Project palette
Ink
#0B1120
Page background
Slate
#1E293B
Cards and code blocks
Signal
#38BDF8
Links and accents
Alert
#F43F5E
Critical severity only
Type system
Display
Inter (weights 600–800)
Body text
Inter (400–500)
A single family, two roles. Report excerpts use the system monospace stack: no additional font is downloaded.
What's under the bonnet.
- Next.js
- React
- TypeScript
- Tailwind
- Vercel
Next.js with static rendering
Every page is generated at build time. A product showcase has no dynamic data to serve: permanent server rendering would cost latency and attack surface, for nothing. The complete HTML is served from the CDN.
Zero third-party dependencies on load
No Google fonts, no external analytics script, no chat iframe. On a security website, every third-party domain called on first render is an argument against yourself — and a real entry point into the supply chain.
Complete security headers
Strict Content-Security-Policy, HSTS with preload, Referrer-Policy, a Permissions-Policy closed by default. It is the minimum expected of a security vendor — and a technical prospect's first reflex is to open the Network tab and check.
An open-source engine, openly acknowledged
The execution engine is built on the open-source Strix project. The site says so and links to it rather than hiding it: for this audience, traceability of the technical building blocks is worth more than a black box.
How the site makes itself findable.
Comparison searches rather than generic ones
“Automated pentest”, “DAST vs manual pentest”, “vulnerability scanner false positives”: mid-funnel searches, low in volume, very high in intent. Fighting over “cybersecurity” would have achieved nothing.
SoftwareApplication markup
SoftwareApplication JSON-LD with category, operating system and offer, plus a FAQPage covering recurring objections (“can the agents break my production environment?”). These are the answers AI assistants cite.
Carefully crafted social metadata
The product gets shared on Slack and LinkedIn between peers. Open Graph and the Twitter card are therefore treated as an acquisition channel, with a dedicated image rather than the logo.
Usable by everyone.
Since June 2025, the European Accessibility Act has required digital accessibility from a large share of online services. We build it in at the design stage rather than retrofitting it.
AAA contrast on body text
The dark theme is the classic trap: light grey on dark grey. Every colour pair was measured; body text is at 12:1, secondary labels at 7:1.
Code blocks navigable by keyboard
Report excerpts scroll horizontally on mobile: they are focusable and announced as scrollable regions, otherwise their content could not be reached without a mouse.
What was delivered.
- Home — proof, promise, trial
- How it works — the cycle of an agentic audit
- Reports — anatomy of a deliverable
- Pricing
- Documentation & open-source engine
How the project unfolded.
Scoping
Interviews with the product team, defining the objections to address and in what order.
Content
Technical copy approved by the engineers before any mock-up.
Design
Dark system, proof component, type scale.
Development
Static Next.js, security headers, performance budget.
Launch
Security acceptance testing, header checks, Search Console.
What we are often asked.
More of our work
GDPR compliance & SaaSKonsent by Kayzen
A banner vendor that audits banners is both judge and party: independence was the product.
Data & weather serviceMétéo Climat France
358 indexable pages, a map animated over 72 time steps — and not a single line of framework.
Trades & constructionBTP EA Rénovation
Six fields, not one more: the form is the product.
The same high standards, for your website.
A free audit of your current site, a quote within 24 hours and written reasoning — like the case study you have just read. Pay in three interest-free instalments; local funding schemes checked before you sign.