Pillar 01
An authorised, methodical attempt to break into your systems — conducted in daylight, under written scope, and documented so your team can close every door we opened.
A penetration test is not a scan. A scanner tells you a door might be unlocked; a test opens it, walks through, and shows you what was on the other side. The value is in the chaining — the low-severity finding that is worthless alone but becomes a domain compromise when combined with two others.
What we check
What the internet already knows about you: domains, exposed services, forgotten subdomains, leaked staff credentials.
Every reachable port and service, internal or external, and the software version it is stuck on.
Injection, broken access control, authentication and session handling, and the admin panel nobody remembered.
What a foothold becomes: local escalation, credential reuse, and lateral movement across trust boundaries.
Findings combined the way a real intruder would combine them, with proof at each step rather than assertion.
Targets validated against the authorised allowlist before a single packet. Out-of-scope hosts are refused in code, not trusted to a checkbox.
Featured Build · 2026
An engine that runs an end-to-end, by-the-book penetration test on its own and produces an auditor-defensible report — built on a single structural commitment: the language model never gets a shell.
The dangerous capability — deciding and acting — lives entirely in auditable, allowlisted code. The model contributes only the one capability it is safe to give it: narrating after the fact. Neither half can do the other's job, and that separation is the product.
descriptionRead the whitepaperarrow_outwardHuman-authored, version-controlled, ordered steps. Each names exactly one tool from a fixed allowlist — no raw commands, no flags. The engine walks the list; it never improvises.
Every tool is an argv-spawned binary with hard-coded flags and timeouts. Metacharacters are never interpreted because no shell is involved. A finite action space instead of an infinite one.
Per-step scope lock, target lock and kill switch, re-checked at every step, so a long run cannot drift out of bounds.
Findings climb from Detected to Confirmed to Exploited, earning each tier with real proof, scored by a spec-exact CVSS 3.1 calculator following the published FIRST.org equations.
Benign probes promote a finding only on a definitive positive, bound to the exact port probed. It never invents a finding and never mutates its input.
The model, off the execution path and optional, writes the executive summary. Swap it for a random-text generator and the worst case is that the summary reads badly — never that it attacked the wrong host.
How it works
We agree in writing which systems are in scope, which are off limits, and when testing may run. You sign before anything begins.
Passive first — what is publicly visible without touching your infrastructure — then active enumeration inside the agreed boundary.
Findings are pursued to proof. Every action is hash-chained into an append-only log so you can show exactly what was done.
One branded document with severity, business risk and remediation. Once you have fixed it, we verify and reissue.
A twenty-minute call is enough to agree what gets checked and what it costs. Nothing on your systems is touched until you have signed to say we may.
Book a free callarrow_forward