industry-standard intel
Findings your auditor already reads.
Continuous, evidenced offensive testing is exactly what SOC 2, ISO 27001 and PCI DSS ask you to show. agent red produces it as a by-product of running — scored, mapped and traceable to the operation that found it, so your evidence trail writes itself.
- severity
- CVSS v4.0 vector, scored server-side
- weakness
- CWE identifiers
- technique
- MITRE ATT&CK and ATLAS mappings
- ai systems
- OWASP Top 10 for LLM applications
- proof
- reproduction steps and hashed evidence
- fix
- remediation guidance, then a retest
- custody
- agent reasoning vs ingested scanner output
- review
- proposed → confirmed by a human, deduplicated
- SOC 2
- CC4.1 monitoring · CC7.1 vulnerability detection
- ISO 27001:2022
- A.8.8 management of technical vulnerabilities
- PCI DSS v4.0
- 11.3 vulnerability scans · 11.4 penetration testing
- NIST CSF 2.0
- ID.RA risk assessment · DE.CM continuous monitoring
- your own policy
- patch SLAs measured against real exposure
what we actually promise
Nine straight answers.
A short, specific list beats a long, comforting one.
No AI keys on your box
Model and tool traffic goes through your org's gateway, which adds the key on the way past. There is nothing on the agent worth stealing.
Nothing can dial in
Agents dial out to a private tailnet and open no ports. Teammates get one-way reach to your agents only — never another org's.
Remove a person, drop their devices
Take someone out of the org and every machine they joined is cut off — not just barred from rejoining.
Isolation enforced by the database
Every row is scoped to your org by row-level security in Postgres itself, not by app code that could forget.
Prove it's yours, or no attack
Before a host is touched you add a DNS TXT record or a file to it. Scope is compiled and enforced inside the agent.
Signed rules before anything intrusive
Penetration tests and red team operations won't start until the rules of engagement are signed and authorization is recorded.
The AI can't inflate a finding
Operators propose a CVSS vector; the gateway scores it. A compromised or over-eager agent can't forge a critical.
Pause, detach, or cut web access
Pause an operation and every turn stops. Pull an agent mid-flight. Disable the browser terminal per agent, SSH-only.
It stops at zero
When the balance runs out, operators stop making calls. No runaway agent, no runaway bill.
the honest version
the approval gate is a speed bump, not a cage.
Read-only work runs on its own; anything that writes or reaches further stops and asks. But once you approve a command, it can do whatever that machine's account can do. So choose the containment level to match the box, and give it an account that can only touch what you'd be willing to lose.
only test what you own
Point it at your own systems, and nothing else.
A tool that tells you the truth about how much damage it could do.