Platform
One loop: find it, attack it, close it.
Most tools stop at "here are 4,000 things that could theoretically be bad". We keep going until something is provably bad, then hand you the fix.
Discovery that keeps going after the demo
Seed one domain. We pull certificate transparency, DNS, cloud ranges, code hosts and the odd forgotten S3 bucket, then re-check every six hours. Shadow IT is not a one-time report.
- Subdomain + wildcard enumeration
- Cloud asset attribution (AWS, Azure, GCP)
- Technology and version fingerprinting
- Ownership guesses you can correct once
AI agents that actually try it
Each candidate finding gets handed to an agent with a narrow brief and a hard rule: prove it without breaking it. No exploitation of destructive classes, ever.
- Auth bypass, IDOR, exposed panels
- Chained findings across hosts
- Evidence: request, response, screenshot
- Read-only by default, approval-gated beyond
Fixes, routed where work happens
A finding without an owner is a finding that survives the quarter. We assign, route and re-test automatically once you push.
- Jira, Linear, GitHub issues
- Slack digest, weekly not hourly
- Auto re-test on deploy
- Audit-ready PDF for the compliance people
Which report would you like to see?
Monthly report · 1–30 Sep 2026
acme.com
Exposure score
68/100
9 points worse
0 = invisible, 100 = advertised
Money at risk
€2.4M+€0.9M
New assets found
41412 total
Critical + high open
12+3
Past agreed SLA
6+2
What changed this month
Admin panel opened itself to the internet
api.acme.com/admin — an agent walked in and photographed customer records.
Source: config change, 29 Aug
Halden came with 34 assets and no paperwork
New domains, a legacy VPN portal, two public buckets. None in the CMDB.
Source: cert transparency, 22 Aug
Open too long
| Critical | Database replica with no password db-replica.acme.io:5432 Owner · ticket: Unassigned | 94 dSLA 7 |
| Critical | Backdoored dependency in build image legacy.acme.io · CVE-2024-3094 Owner · ticket: Platform · SEC-4821 | 71 dSLA 7 |
| High | Legacy VPN portal, no MFA vpn.halden.io Owner · ticket: IT Ops · OPS-1190 | 52 dSLA 30 |
Critical
FF-2481
Confirmed by agent
Admin panel reachable without authentication
api.acme.com/admin
Evidence
GET /admin HTTP/1.1 Host: api.acme.com HTTP/1.1 200 OK X-Powered-By: Express < dashboard rendered, no auth prompt >
Steps to reproduce
- Request /admin with no session cookie and no Authorization header.
- Server returns 200 with the full dashboard markup.
- Customer records are readable at /admin/api/customers?page=1.
- Cause
- Routing change on 29 Aug removed the auth middleware
- What it reached
- 1,204 customer records, read-only
- Human-verified
- M. Kalnina, 30 Aug · 3 screenshots
Routed to: SEC-4821 · in progress
Verification: Re-tested automatically on every deploy to api.acme.com
Sample report. Figures are illustrative; technical detail stays in English, as it does in the real thing.
Rules of engagement
Friendly means friendly. Here's what we will never do.
No destructive payloads
No data exfiltration
No scanning what you do not own
Everything logged, exportable