P-01■ online
probe/recon
Continuously finds forgotten subdomains, open ports, exposed buckets and shadow SaaS before anyone else does.
$ probe recon --watch
01 · How it works
Nine minutes,
start to finish.
An example incident at 3am. Containment runs on playbooks you approve in advance. Anything outside them waits for a human.
-
+0m 00s · detect
A stolen access key hits prod
probe/identity sees the key used from a new country, calling APIs it has never touched.
-
+0m 19s · confirm
Confirmed as a real breach
Sign-in, network and API logs are correlated. It's not a false positive, so the incident opens.
-
+0m 53s · contain
The attacker is cut off
Key revoked, sessions killed and the touched host isolated, all by your pre-approved playbook.
-
+4m 28s · scope
Blast radius is mapped
Every action the key took is traced, and what was read and what was changed are both listed.
-
+8m 50s · resolved
Resolved in under 10 minutes
Root cause closed, a full report in Slack, and your team wakes up to a closed incident.
02 · The console
Always on.
Always hunting.
Each agent owns a slice of your environment and watches it every second, so the clock starts at detection, not when someone checks a dashboard.
Agent queue · example
>
#P-0117map the edge
12 hits
>
#P-0114confirm the ssrf
4 hits
>
#P-0109chase stale tokens
2 hits
>
#P-0103diff the cloud
0 hits
>
#P-0098draft the patch
1 hit
Incident log · example
- 03:16:02sysincident closed · 8m 50s · report sent
- 03:11:40reconblast radius mapped · 2 buckets read
- 03:08:05identitykey revoked · 3 sessions killed
- 03:08:04cloudhost i-0a7f isolated
- 03:07:31identitybreach confirmed · incident opened
- 03:07:12identitykey AKIA…7Q used from new country
03 · Agents
Six agents.
Zero shifts.
Specialists, not one generalist. Run them all or start with the one that keeps you up at night.
P-02■ online
probe/vuln
Checks reachable services and dependencies against new disclosures within minutes, and confirms the ones that are actually exploitable.
$ probe vuln --confirm
P-03■ online
probe/identity
Watches your IdP for impossible travel, stale admin grants, MFA gaps and tokens that outlived their owners.
$ probe identity --idp
P-04■ online
probe/cloud
Diffs your cloud posture on every deploy: public snapshots, wildcard IAM, and security groups that drifted open.
$ probe cloud --diff
P-05■ online
probe/code
Reads every merge for leaked secrets, injection paths and risky dependency bumps, and comments where developers already work.
$ probe code --on-merge
P-06■ online
probe/patch
Turns confirmed findings into tested pull requests with the fix, the proof and a rollback note attached.
$ probe patch --draft
04 · Built for enterprise
Autonomous,
not unsupervised.
- R-01Read-only by default
Agents observe and test. Anything that changes state waits for an explicit grant.
- R-02Scoped to what you own
Targets come from your verified inventory. Out-of-scope requests are refused and logged.
- R-03You decide what's automatic
Containment runs on playbooks you approve ahead of time. Anything outside them waits for a human in Slack, the ticket or the PR.
- R-04Every action leaves a line
A full, exportable audit trail of what each agent did, when, and why.
probe/patch · request #0311■ needs approval
- finding
- public read on bucket assets-staging
- blast radius
- 3 internal build artifacts
- proposed
- set ACL private · add deny policy
- rollback
- one command, logged
05 · Early access
Sleep on it.
We're onboarding a small group of enterprise security teams. Tell us where to reach you and we'll set you up.