Map the real estate, not the believed estate.
The swarm enumerates your external surface the way an intruder would: certificate transparency, DNS history, cloud asset fingerprints, leaked naming conventions. Clients typically discover 4–9× more live assets than their inventory holds.
# what lands in your scope sheet assets live hosts, panels, preview envs, shadow SaaS edges trust boundaries, SSO flows, vendor panels watchlist tech fingerprints → versioned vuln surface
One way in, demonstrated.
Agents probe each asset for the weaknesses that actually chain: exposed CI variables, stale preview environments, permissive CORS, forgotten staging auth. Nothing reports as a finding until it executes.
# foothold classes we hunt first exposed .env / .git / actuator / debug panels identity session minting, oauth client misuse, JWT confusion injection template, query, and prompt — in that order of yield
Credentials are the pivot, not the prize.
Footholds are harvested for everything an attacker would take next: task credentials, deploy keys, role ARNs, service tokens. Escalation chains are scoped — iam:PassRole abuse is demonstrated on a canary role, never against your production admins.
Lateral movement, on the record.
Each hop is logged, timestamped, and reversible. The swarm moves the way the graph allows — role assumptions, network reachability, token scopes — and stops exactly at your rules of engagement line.
Impact you can show the board.
Proof is a canary record read, a controlled write to a staging status page, a row count — never a payload detonated. The finding lands with the replayed chain, the blast radius, and the exact line to sever.
The leash is the product.
Autonomy is only deployable because it is constrained. Three layers, always on:
# rules of engagement — condensed scope hard-blocked: anything outside the signed asset list classes disabled: destructive, DoS, exfil-beyond-canary gates human approval required: pivots past tier-2, any write kill global halt in <200ms via operator dashboard
Speak MITRE, think chains.
Findings map to ATT&CK tactics so your blue team can route them — but severity is always scored on the demonstrated blast radius, not the technique name.
| Yegg phase | ATT&CK tactics | Evidence we return |
|---|---|---|
| Recon | TA0043 Reconnaissance | Asset graph + discovery diff |
| Foothold | TA0001 Initial Access | Replayed request/response |
| Escalate | TA0004/TA0006 PrivEsc + CredAccess | Scoped role assumption log |
| Pivot | TA0008 Lateral Movement | Hop-by-hop timestamps |
| Prove | TA0010/TA0040 Exfil + Impact | Canary proof, blast radius |
See your own chain.
Scoped engagements start with a domain. The first recon pass is usually the surprise.
Scope an engagement →