Autonomous, and under your control
Running an attacker against your live systems is only acceptable if the controls are real and enforced in software. Here is exactly how scope, safety, and your data are handled.
Four controls, enforced in the system
Not promises in a slide. Each of these is a property of how the agent runs, not a policy we ask you to trust.
Scope is a wall
Testing stays inside the assets and windows you define, enforced in software rather than left to judgment in the moment. Discovery never becomes a reason to reach further.
Non-destructive by default
The agent runs read-mostly, honors rate limits, and paces its traffic. Anything with real side effects is blocked unless you authorize it in writing.
Approval gate and kill switch
Sensitive actions wait for your explicit approval, and you can stop any run instantly. You are never watching a black box you cannot halt.
Human validation on demand
Route any finding, or an entire run, through a senior practitioner before it reaches your tracker, when you want a person accountable for the result.
Held only as long as the work requires
The agent runs from infrastructure we scope with you, and it can be routed through your own egress where a fixed source address is required. What it learns about your systems is treated as engagement data, not training material.
The full commitments, including retention and destruction, live on our Trust and Data Handling page.
- Encrypted in transit and at rest. Engagement data is protected end to end while we hold it.
- Least access. Only the assigned team can reach your data, for the duration of the work.
- Destruction on your schedule. Report material is removed on the timeline you set.
- Routed through your egress. Where you need a fixed, allowlisted source address, the agent uses it.
Mapped to the standards your auditors expect
Traditional offensive-security method, plus the emerging frameworks for testing AI systems.
Bring it to your security team
We are happy to walk your security and compliance stakeholders through the controls before anything runs against your systems.