Cybersecurity: AI Pentest
Human-gated, evidence-based proof of what is exploitable
CAIVA plans, finds and maps the reachable path from a foothold to the crown jewel — then waits. A person approves, the exploit runs within bounds, and what comes back is evidence, not a persistent foothold.
- 6 lanes cover web apps, hosts, Active Directory, cloud, containers and code, each with checks suited to that asset type.
- 17 exploitable attack paths proven in the sample estate, each with evidence attached.
- Human gate every exploit waits for a named approver before it runs, and stops at proof.
The pipeline
Plan, Find, Gate, Exploit, Report
Five stages, and the gate is the one that matters: nothing is exploited until a human says so. Watch a run advance — coverage, assets done, and the named approver at the gate.
Pentest run RUN-318
Scheduled run across the whole estate, with credentials
Approved at the gate; exploitation is bounded to proof.
- Approved by
- A. Rahman, SecOps lead
- Approved at
- 26 Oct 2026, 09:41
- Lanes
- Web, host, Active Directory, cloud, Kubernetes, code; deep (with credentials)
Guided tour: step 1 of 4
The five stages of a run
- What it means
- Plan the scope, find weaknesses, stop at the gate, prove the exploit, then report.
- Why it matters
- You always know exactly where a test stands.
- What to do
- Nothing is needed from you until the run reaches the gate.
Plan
Scope the engagement to the assets and lanes you choose.
Find
CAIVA enumerates and ranks what is reachable and exposed.
Gate
A coverage gate and a human approval stand between finding and exploiting.
Exploit
Bounded proof-of-exploitation — only after approval.
Report
Findings write back to the vulnerability register with the evidence attached.
Six lanes
The right capability, routed to the right lane
CAIVA works one lane at a time; the rest stand down. Each lane has its own posture — surface, surface-with-creds, or deep.
Lane routing
CAIVA routes each asset to its lane — the right capability runs, the rest stand down
External / Web
Web-application and perimeter testing, from surface probing to deep, authenticated exploitation.
Host / Network
Network and host assessment and exploitation — services, misconfigurations and credential attacks.
Active Directory
Directory enumeration and attack-path analysis, through to domain-privilege exploitation.
Cloud (AWS / Azure / Entra)
Cloud posture and misconfiguration review, with exploitation where credentials allow.
Container / K8s
Container image and Kubernetes configuration checks against known weaknesses.
Code / Repo
Secrets and source-code scanning — detection only, no exploitation.
The human gate
Nothing fires until a person approves
The scan completes and findings rank; the agent proposes a validation for the top finding and queues it, waiting. That gate is the product.
Scan complete · ranked
AI agent proposes a validation
Attack paths
How a foothold reaches the crown jewel
The reachable path lights up hop by hop, from the internet to the choke-point and on to the crown jewel, with the one hop that breaks the most paths flagged.
Attack-path exposure
How a foothold reaches the crown jewel
- 1Internetuntrusted
- 2edge-proxy10.20.40.5
- 3app-api-0110.20.10.24
- 4dc-01Domain Controller
- 5fin-db-02crown jewel
Evidence, not a foothold
Proof comes back; the foothold does not
Output, a screenshot and a plain-English verdict return to the register. The exploit is bounded and leaves nothing behind.
Exploit Desk · evidence
Two-phase: scan → human gate → prove
No exploit runs until a person approves it. This is where assurance earns trust.
CAIVA proves the risk and stops — no persistence, no lateral movement, no data touched.
An attacker already on the LAN can take full SYSTEM control of the finance database host. This isn't theoretical — it ran.
See AI Pentest on your estate
Tell us a little about your environment and we’ll put together a walkthrough tailored to it.
- Agentless discovery
- Real-world prioritisation
- Human-gated proof