AI agents · Red Agent · Pentesting

Early access · Enterprise

Red Agent.
Thinks in attack paths.

Findings rarely hurt on their own. Red Agent will chain them together the way an attacker would, and show you the path, step by step. Coming to Enterprise first.

Join early accessTalk to us
// AndroidManifest.xml <activity .PromoActivity android:exported="true"> // PromoActivity.kt loadUrl(intent.data) // WalletBridge.kt @JavascriptInterface fun token() = session.token 1 2 3 Each one, a Medium. Together, not. = account takeover, from one tapped link. PATH · 3 STEPS CRITICAL Each step sent to Green Agent

What we're building

An attacker's patience,
on your side.

  • Chains

    Findings into paths

    Connects issues across files, components, and SAST, DAST, and SCA results.

  • Proves

    Each step, with evidence

    Walks the path and records what happened, so the risk is concrete.

  • Stays in scope

    Your targets, your rules

    Runs only against the builds and environments you name.

  • Asks first

    A person approves every run

    No surprise testing. See Human in the loop.

  • Hands off

    Every step to Green Agent

    So you can break the chain at its cheapest link.

  • Repeats

    When your app changes

    Not once a year, when the pentest budget comes around.

Red Agent is in development. Details may change before release.

Example path

Three small problems. One big one.

  1. 1
    MediumSAST · AndroidManifest.xml:41

    PromoActivity is exported and accepts any link

    Any app, or any web page, can open it with a URL of its choosing.

  2. 2
    HighSAST · PromoActivity.kt:28

    The WebView loads that link with a JavaScript bridge attached

    The attacker's page now runs inside your app, next to your wallet code.

  3. 3
    MediumDAST · WalletBridge.kt:12 · seen at runtime

    The bridge hands the session token to the page

    One JavaScript call, and the token leaves the device.

  4. Impact · CriticalAccount takeover from a single tapped link.
    See the fixes

Where Red Agent fits

  1. 01ConnectUpload a build or link CI
  2. 02ReadSAST, DAST, and SCA
  3. 03TriageFalse positives out, ranked
  4. 04 · This pageAttack pathsRed Agent chains findings
  5. 05FixGreen Agent writes it
  6. 06 · EnterpriseReviewPeople sign off

Fair questions.

When can we use it?

It's coming to Enterprise first. Early access opens in Q1 2027. Join early access to try it sooner and help shape it.

Will it run against production?

Only if you say so, in writing. Every engagement starts with agreed rules of engagement: target environments, allowed techniques, test windows, and a named contact who can stop testing instantly. By default, Red Agent tests staging.

How is this different from a pentest?

A pentest is a snapshot. Red Agent is built to run again whenever your app changes, with a person approving every run and every fix landing as a diff.

Know the path before anyone walks it.

Join early access