SAK Technologies · red-team platform

SAK Red Teaming

SAK Red Teaming is our own red-team platform. Most firms run a red team out of a consultant's laptop and a pile of scripts. We built the platform instead — a fleet of specialist agents that discovers your attack surface, confirms the real weaknesses, and shows the paths that actually reach your crown jewels. Authorized in writing, safe by default, and yours to have us run or to license for your own team.

Authorized & safe by default

A penetration test that proves impact, not a CVE list

We discover what an attacker can reach, validate the findings that are genuinely exploitable, and rank them by the business risk they carry — so your board sees the handful of paths that matter and the one fix that breaks each of them.

External and internal assessment under one control plane — the surface you know and the surface you forgot you owned
Findings tagged to the exact MITRE ATT&CK technique, chained into the attack paths that reach your critical systems
Priority by reachability, known-exploited status (KEV) and exploit probability (EPSS) — not raw CVSS
A dedicated AI-security pillar: LLM apps, Shadow-AI discovery, model supply chain and AI governance
Business risk quantified in money (FAIR), not a heat map of coloured squares
A board report and a technical report from the same evidence, with every action logged to a tamper-evident chain of custody

35specialist agents

326vetted tools

Internal + externalone control plane

Why clients run it with us

Nothing runs until you sign the scope — the platform refuses an unsigned or out-of-window engagement
Safe by default: it starts look-only, and anything that touches a live system needs your explicit, recorded permission
Assessment, not evasion — no stealth or anti-detection features, by design
Every finding is proven with captured evidence; false positives are removed before you see the report
Re-test built in: fix, we verify, the report shows what changed

Request a red-team demo

Consultant-led · written authorization required · KSA data-residency options

You decide how far we go

Four levels. Passive by default. You can stop at any point.

Moving up a level is always a deliberate, recorded decision — a second named approver and a written reason before anything touches a live system. The report shows exactly what you authorized versus what was achieved.

Level	Intrusive?	What happens	What we need from you
1 · Passive	No	Recon and analysis from public and existing data only.	Signed scope.
2 · Safe-Active	No	Read-only probes — banner, version, TLS and config reads. Non-destructive.	Signed scope + non-intrusive permission.
3 · Exploit-Validated	Yes	A single, non-destructive proof of concept to confirm one real finding.	+ written intrusive authorization, a second approver and a recorded reason.
4 · Full Pentest	Yes	Chained, in-scope exploitation through the penetration phases you tick — each with a defined stop point.	+ per-phase authorization.

72% of the arsenal is non-intrusive. Of 326 vetted tools, 236 are read-only recon; 63 intrusive and 27 exploit tools are hard-gated behind explicit authorization. Crown-jewel data is reached and proven, never copied out; simulated exfiltration uses benign canary tokens only — never your real data; any simulated persistence is cleanly removed.

The platform

What a fleet of 35 agents covers

Each agent is a specialist, tagged with the MITRE ATT&CK technique it exercises. They run under one control plane that enforces your authorization below the agents — an agent requests, the platform decides, and no agent can escalate itself.

External

Attack-surface discovery

Subdomain and asset enumeration, service and port fingerprinting, TLS and certificate posture, web security headers, exposed services and misconfiguration, and OSINT on data that has already leaked.

ATT&CK Reconnaissance

Identity

Active Directory & cloud identity

The path modern breaches actually take: AD attack paths, delegation and ticket abuse, and cloud identity and IAM privilege-escalation chains — because real compromises are identity, not a lone CVE.

ATT&CK Privilege Escalation · Lateral Movement

Cloud

Cloud & Kubernetes posture

IAM privilege-escalation paths, storage and secret exposure, and container and Kubernetes posture — with the client's AWS, Azure or GCP read as live data when connected.

AWS · Azure · GCP · K8s

App

Web, API & secrets

Web exposure and misconfiguration, API security including unauthenticated object access, and credential and secrets exposure — probed within scope and within rate limits.

ATT&CK Initial Access

AI

The AI-security pillar

Five agents covering LLM application security, Shadow-AI discovery, AI model and supply-chain risk, AI data privacy, and AI governance — mapped to OWASP LLM Top 10, OWASP ML Security Top 10 and MITRE ATLAS. 51 AI coverage points in all.

NIST AI RMF · EU AI Act · ISO 42001

Purple

Detection validation

Every emulated technique is measured against your own telemetry — Splunk, Microsoft Sentinel, Elastic, CrowdStrike or Defender — to score what your SOC actually caught, with deployable detection content handed back for each gap.

SOC readiness scorecard

Analysis

Correlation, scoring & attack paths

One clean, de-duplicated list instead of a raw dump. Severity × exploitability × asset value × exposure, reachability-aware, chained into the attack paths that reach your crown jewels and the choke points that break them.

KEV · EPSS · FAIR $ risk

Evidence

Report, remediation & retest

Board and technical reports, remediation plans, a compliance view, and a re-test workflow — fix, we verify, the report shows the delta. Every action carried on a hash-chained, tamper-evident audit log.

Board + technical · MD / JSON / HTML / PDF

How we run it

From signed scope to verified fix

The workflow you see in every engagement. Re-runs compare against the last assessment and report what changed.

Step 1
Authorize & scope
You sign the scope — the in-scope assets, the window, the named approvers. We lay out which agents run against which assets, and you approve the exact plan before anything starts.
Step 2
Discover & analyze
Non-intrusive discovery of your attack surface, then vulnerabilities, misconfigurations and exposures — correlated and de-duplicated into one clean list.
Step 3
Validate the real ones
Scored by business risk, and — where you authorize it — confirmed with a single, non-destructive proof of concept and captured evidence. False positives removed.
Step 4
Report, fix, re-test
Board and technical reports with the attack paths and the fixes. You remediate; we re-test and mark each finding verified, with the delta on the record.

How you can buy it

Have us run it — or license the platform yourself

The same platform, four ways. Take it as a service we deliver, or license it directly: a per-company subscription for your own team, or a multi-tenant licence for an MSSP to run across its whole book of clients. Each licence is per-company, KYC-verified, and enforces the signed-authorization gate.

Managed engagement Service: A scoped, consultant-led red-team or penetration-test engagement — point-in-time or continuous — with the board and technical reports, the compliance view, and the re-test to prove the fixes landed. The usual way to start.
vCISO-led programme Service: Run as part of a vCISO engagement, so offensive testing feeds the same roadmap, risk register and board pack — with the deliberate separation that a tester should not assess controls they helped design.
Company licence Subscription: License the platform for your own security team to run internal detection and penetration themselves — a per-company subscription, under the same authorization gate and audit trail, with the continuous scheduler for always-on validation. Priced per company, not per seat.
MSSP licence Multi-tenant: A multi-tenant licence to run the platform across a portfolio of clients — tenant isolation, a REST API with role-based access, white-label reporting, and per-client usage metering. One licence covering a book of business.

Licences are issued per company after a short KYC step and carry the signed-authorization enforcement built into the platform — a safeguard for an offensive tool, and one your own auditors will want to see.

Being straight with you

Where this is today

We would rather you hear this from us than find it in a demo. The buyer who reads this section carefully is the buyer worth having.

Honest position	What that means for you
The platform is real and running	The control plane, the authorization gate, the recon agents, the scoring, the audit trail and the reporting are built and working — not slides. The AI pillar and detection validation are in.
It is early, and we are selective	We are taking a small number of engagements and design partners now, while identity, cloud and exploitation depth keep deepening. You get senior attention and influence over the roadmap.
Exploitation stays operator-licensed	The platform orchestrates, validates and evidences. Offensive payloads come from licensed, operator-supplied backends — we ship no exploit payloads.
Start non-intrusive, same day	The fastest way to see value is a non-intrusive assessment of your real external surface, authorized at Level 1–2. No access required, nothing touched.

Next step

See it run against your own surface

A short call to confirm scope, then a non-intrusive assessment of your real external attack surface — authorized, safe by default, and yours to keep whether or not we go further.