The platform / Threat Exposure Center
SAK Technology · 2 · Find itFind what attackers can reach. Prove it. Show how to detect it.
Not a red-team tool: a Threat Exposure Center. A point-in-time penetration test is a snapshot, and exposure is continuous. Threat Exposure Center discovers what you expose, computes the real attack paths across Active Directory, cloud, Kubernetes and AI, validates them with evidence, and hands you the fix that breaks each path and the detection that catches it. Authorized in writing, safe by default, and yours to have us run or to license for your own team.
A penetration test that proves impact, not a CVE list
We discover what an attacker can reach, validate the findings that are genuinely exploitable, and rank them by the business risk they carry — so your board sees the handful of paths that matter and the one fix that breaks each of them.
- External and internal assessment under one control plane — the surface you know and the surface you forgot you owned
- Findings tagged to the exact MITRE ATT&CK technique, chained into the attack paths that reach your critical systems
- Priority by reachability, known-exploited status (KEV) and exploit probability (EPSS) — not raw CVSS
- A dedicated AI-security pillar: LLM apps, Shadow-AI discovery, model supply chain and AI governance
- Business risk quantified in money (FAIR), not a heat map of coloured squares
- A board report and a technical report from the same evidence, with every action logged to a tamper-evident chain of custody
Why clients run it with us
- Nothing runs until you sign the scope — the platform refuses an unsigned or out-of-window engagement
- Safe by default: it starts look-only, and anything that touches a live system needs your explicit, recorded permission
- Assessment, not evasion — no stealth or anti-detection features, by design
- Every finding is proven with captured evidence; false positives are removed before you see the report
- Re-test built in: fix, we verify, the report shows what changed
Consultant-led · written authorization required · KSA data-residency options
Four levels. Passive by default. You can stop at any point.
Moving up a level is always a deliberate, recorded decision — a second named approver and a written reason before anything touches a live system. The report shows exactly what you authorized versus what was achieved.
| Level | Intrusive? | What happens | What we need from you |
|---|---|---|---|
| 1 · Passive | No | Recon and analysis from public and existing data only. | Signed scope. |
| 2 · Safe-Active | No | Read-only probes — banner, version, TLS and config reads. Non-destructive. | Signed scope + non-intrusive permission. |
| 3 · Exploit-Validated | Yes | A single, non-destructive proof of concept to confirm one real finding. | + written intrusive authorization, a second approver and a recorded reason. |
| 4 · Full Pentest | Yes | Chained, in-scope exploitation through the penetration phases you tick — each with a defined stop point. | + per-phase authorization. |
Most of the arsenal is non-intrusive. Every tool runs through a vetted adapter under the permission lattice — read-only recon by default, with intrusive and exploit tools hard-gated behind explicit authorization, and exploitation running through operator-licensed backends (we ship no exploit payloads). Crown-jewel data is reached and proven, never copied out; simulated exfiltration uses benign canary tokens only — never your real data; any simulated persistence is cleanly removed.
What a fleet of 43 agents covers
Each agent is a specialist, tagged with the MITRE ATT&CK technique it exercises. They run under one control plane that enforces your authorization below the agents — an agent requests, the platform decides, and no agent can escalate itself.
Attack-surface discovery
Subdomain and asset enumeration, service and port fingerprinting, TLS and certificate posture, web security headers, exposed services and misconfiguration, and OSINT on data that has already leaked.
ATT&CK ReconnaissanceActive Directory & cloud identity
The path modern breaches actually take: AD attack paths, delegation and ticket abuse, and cloud identity and IAM privilege-escalation chains — because real compromises are identity, not a lone CVE.
ATT&CK Privilege Escalation · Lateral MovementCloud & Kubernetes
AWS IAM, Azure RBAC and GCP IAM privilege-escalation paths, storage and secret exposure, and live Kubernetes RBAC analysis — your cloud read as live data when connected.
AWS · Azure · GCP · live Kubernetes RBACWeb, API & secrets
Web exposure and misconfiguration, API security including unauthenticated object access, and credential and secrets exposure — probed within scope and within rate limits.
ATT&CK Initial AccessThe AI-security pillar
Seven agents covering LLM application security, jailbreak resistance, AI-agent abuse, Shadow-AI discovery, model and supply-chain risk, AI data privacy and AI governance, mapped to the OWASP LLM Top 10 and MITRE ATLAS.
NIST AI RMF · EU AI Act · ISO 42001Detection testing
Your SIEM rule logic is tested against 209 labelled detection use cases offline; and where Splunk, Sentinel, Elastic, CrowdStrike or Defender is connected, we also measure whether it alerted on the engine's own live recon — a narrower, real signal kept separate. Deployable detection content for each gap.
Rule-logic + live-recon signalCorrelation, scoring & attack paths
One clean, de-duplicated list instead of a raw dump. Severity × exploitability × asset value × exposure, reachability-aware, chained into attack paths — tagged validated / partial / theoretical — with a computed choke point and blast-radius ranking.
KEV · EPSS · FAIR P10/P50/P90Report, remediation & retest
Board and technical reports, remediation plans, a compliance view, and a re-test workflow — fix, we verify, the report shows the delta. Every action carried on a hash-chained, tamper-evident audit log.
Board + technical · MD · JSON · HTML · PDF · DOCXOne platform, every surface an attacker uses
43 specialist agents and a vetted tool arsenal across 26 categories — internal and external, under one control plane. Here is the whole of it.
Attack-surface discovery
Subdomain and asset enumeration, service and port fingerprinting, TLS and certificate posture, security headers, exposed services and OSINT on data that has already leaked.
Active Directory & cloud identity
AD attack paths — Kerberoasting, delegation and ticket abuse — plus Entra ID, Okta and OAuth/SAML/OIDC identity and IAM privilege-escalation chains.
Cloud & Kubernetes
AWS IAM, Azure RBAC and GCP IAM privilege-escalation paths, storage and secret exposure, and live Kubernetes RBAC — your cloud as live data when connected.
Web, API & secrets
Web exposure and misconfiguration, API security including unauthenticated object access, and credential & secrets exposure — in scope and rate-limited.
AI-security pillar · 7 agents
LLM app security, jailbreak resistance, AI-agent abuse, Shadow-AI discovery, AI model & supply chain, AI data privacy and AI governance, mapped to the OWASP LLM Top 10 and MITRE ATLAS.
Network & packet signal
Segmentation and exposure-path testing, plus a packet-capture and protocol-analysis agent for basic packet-level signal.
OT/ICS & resilience
OT/ICS discovery (Modbus, DNP3, S7 — safety-first) and bounded DDoS-resilience & load testing, run only with provider coordination and an auto-abort.
Exploitation & validation
A non-destructive proof of concept confirms findings with a registered validator (~41 finding types); unconfirmed ones stay labelled as such. Validated steps chain into attack paths tagged validated / partial / theoretical — never asserted as proven by default. Payloads stay operator-licensed.
Detection testing
SIEM rule logic tested against 209 labelled detection use cases offline; and where a SIEM/EDR is connected, whether it alerted on the engine's own live recon. Deployable detection content for each gap.
Threat-actor emulation & CTI
Emulate named threat actors and APT groups, prioritised by what is actually used against your sector through CTI feeds (MISP, OpenCTI). MITRE ATT&CK throughout.
Attack paths & risk
Graph attack paths to your crown jewels, reachability-aware prioritisation, KEV and EPSS, a computed choke point and blast-radius ranking, and FAIR financial risk as a Monte Carlo P10/P50/P90 range — not a single invented number.
Report, remediate & retest
Board and technical reports (MD · JSON · HTML · PDF · DOCX) with financial risk and rollback status, remediation plans, compliance mapping, and a fix → retest → verified loop with the delta on the record.
Safe by default throughout. Blast-radius controls, clean rollback of any simulated persistence, production-safe mode and blue-team deconfliction — every action on a hash-chained, tamper-evident audit log, with continuous scheduling and incremental diff so re-runs report only what changed.
Six disciplines, one governed engine
Recon, identity, cloud, web, detection, threat intelligence and reporting usually live in separate tools with no shared picture. Here they share one.
Attack paths, validated
Attack-path computation across Active Directory, AWS, Azure, GCP and Kubernetes, a validation engine, governed exploit tiers, and authenticated web and API testing.
AD · cloud · Kubernetes · web · APIDetections, measured
209 SIEM detection use cases, detection-as-code in five dialects, and SIEM validation that measures how well your rules actually fire.
Splunk · Sentinel · QRadar · Elastic · SigmaThe fix and the detection, together
Every finding carries the fix that breaks it and the detection that catches it, so offense and defense sit in one view. The platform computes the single choke point that breaks the most routes.
Attack tree · choke pointMapped to your assets and adversaries
Known-exploited vulnerabilities (CISA KEV) and exploitation probability (EPSS), overlaid on your own assets and on the 26 threat-actor groups that use your exposed techniques. Threat content arrives as signed packs, including for air-gapped sites.
KEV · EPSS · NVD · 26 actor groupsReviews a scanner does not do
Secure code review, firewall review, compromise assessment and compliance mapping, with financial risk expressed in FAIR terms.
Code · firewall · hosts · complianceAttack and detection for AI
Coverage for shadow AI, prompt injection, jailbreaks, AI-agent abuse and model and data exfiltration, mapped to MITRE ATLAS and the OWASP LLM Top 10.
MITRE ATLAS · OWASP LLM Top 10Reviews a scanner should not be trusted with
Secure code review
A built-in scanner for secrets, SQL injection, command injection and weak cryptography across Python, JavaScript and TypeScript, Java, Go, Ruby, C# and PHP, plus Dockerfile, Terraform and Kubernetes files. It can also drive Semgrep, Bandit, gitleaks, Trivy, Grype and Checkov. Findings are CWE-tagged with file and line.
SAST · SCA · IaCFirewall review
Upload an exported configuration and get a vendor-neutral review: any-any rules, shadowed rules, insecure services and exposed management. 16 configuration formats are parsed, including Palo Alto, Fortinet, Cisco ASA and IOS, Check Point, Juniper SRX, SonicWall, Sophos, Meraki, MikroTik, Huawei USG, pfSense, iptables and nftables.
16 formats · PCI DSS · CIS · NISTCompromise assessment
A host hunt for signs of an intruder: persistence, suspicious processes, rogue listeners, backdoor accounts and keys. 15 checks across Windows and Linux, mapped to ATT&CK, run live over SSH or WinRM, or offline by pasting collector output.
15 host checks · Windows · LinuxIOC and YARA sweep
Sweep hosts for indicators of compromise and YARA matches, with indicator feeds and rule sets managed as content. A bad rule is quarantined, never fatal.
IOC feeds · YARAWhat shipped most recently
A remediation loop that closes itself
A retest closes or reopens each finding with evidence, and Jira and ServiceNow stay in step in both directions.
Fix → retest → verifiedFinding-to-detection handoff
Each finding hands your SOC the rule that catches it, in Sigma, Splunk and Sentinel form, with the log sources it needs.
Sigma · SPL · KQLLifecycle, SLA and risk burndown
SLA clocks by severity, mean time to remediate and a risk burndown, tracked per finding across runs. Scheduled re-runs alert on new high and critical findings by Slack, webhook or email.
SLA · MTTR · alertsExecutive brief and risk trend
A branded board report, plus a now-versus-then risk trend with a plain-language headline your board can read.
Board-readyPortfolio view
One roll-up across every client or business unit, built for MSSPs and groups.
Multi-tenantA secure console, in English and Arabic
Multi-factor sign-in with recovery codes, session revocation, a visible kill switch, and an interface in English and Arabic.
MFA · EN + ARTest what you've already built — not just attack it
The platform does not only run attacks. It tests your SIEM rule logic against 209 labelled detection use cases, named threat actors and malware families — offline, needing no live traffic — and hands back deployable detections. Where you connect a real SIEM or EDR, it also measures whether your system alerted on this engine's own live recon: a narrower, real, live signal, kept separate from the offline rule-logic tests.
SIEM use-case development & testing
An extended use-case library aligned to MITRE ATT&CK (and ATLAS for AI, plus ICS) across endpoint, identity, cloud, SaaS, network, Linux/macOS/ESXi, CI/CD, AI-era and OT — and a validation harness that tests your correlation rules for accuracy, efficiency and logic, the way a detection engineer would.
Ready-to-deploy detections
For every rule that needs work: a prioritised fix backlog with concrete remediation, and native queries you can paste in — Splunk SPL, Microsoft Sentinel KQL, QRadar, Elastic and Sigma.
MITRE ATT&CK-based testing
The full ATT&CK Enterprise matrix — 14 tactics, every base technique selectable — mapped to the agents that exercise it, so coverage is explicit and exportable as a Navigator-style layer.
Threat-actor emulation
Select a named threat actor or APT group; the platform maps its ATT&CK techniques to the agents that test them, runs that emulation, measures what your controls detected, and builds an activity graph.
Malware & C2 family testing
Would your SIEM actually catch a known malware or C2 family in its default configuration — and where does that detection break the moment the operator changes one setting? Coverage reported family by family.
Compliance control testing
A native crosswalk maps every finding to the framework controls it affects — ISO/IEC 27001, SOC 2, NIST CSF and PCI DSS today — with audit-evidence linkage, so a test result stands on its own as control evidence, inside the platform. 60 frameworks are mapped at theme level, including Saudi NCA ECC, SAMA CSF and the ACSC Essential Eight.
Connectors, SIEM forwarding and an API — built in
Config-driven connectors stay inert until you add credentials, then light up. Nothing calls out until you configure it, and every connection is logged.
Cloud platforms
Identity providers
SIEM & EDR
Vulnerability scanners
Ticketing & alerts
Threat intel, vault & evidence
55 connectors across 17 kinds — cloud, identity, SIEM/EDR (10 EDR platforms), scanners, ticketing, threat-intel, vault and evidence. Activity forwarded to your SIEM — CEF over syslog, Splunk HEC, Elastic, Sentinel or QRadar (LEEF), CLI-activated; until one is connected, every event is retained locally and nothing is dropped. A REST API with key, tenant and role-based access drives the platform with real multi-tenant isolation and white-label reporting, and an internal sensor relay reaches networks the platform can't touch directly.
An offensive platform your auditors will actually approve
The hard part of autonomous offensive testing is not the attack — it is the control around it. This is engineered in, not bolted on, and it is why risk-averse and regulated organisations can run it at all.
Authorization gate
Nothing runs without a signed scope that validates: an explicit in-scope allowlist, an engagement window, and named approvers. Anything intrusive needs a second named approver and a recorded reason. Out-of-scope is a hard deny that overrides any allow.
Instant kill-switch
A revocation list is checked — with a phone-home — before any exploit-tier action, so an engagement or a licence can be stopped instantly from outside, reaching a running engagement, not just queued work.
Real-time anomaly auto-suspend
Exploit activity is monitored live and auto-suspends itself if it behaves unexpectedly — a dead-man's-switch for the offensive tier.
Per-operator attribution
Every exploit action is tied to an authenticated individual operator, not just the tenant, through real OIDC and SAML — both with verified signatures — so the audit trail names a person.
Tamper-evident, anchored audit
An append-only, hash-chained log of every action and its authorizing decision — externally anchored with a trusted timestamp when a timestamp authority is configured, so chain of custody holds up to scrutiny.
Blast-radius, rollback & cleanup
Never touches assets you mark no-touch or fragile. Governed artifact cleanup tracks anything a validator creates, auto-removes and verifies it — with an explicit checklist for anything needing a human. Crown-jewel data is proven but never copied out; production-safe mode and blue-team deconfliction markers included.
Assessment, not evasion. By design there are no stealth, anti-detection or defender-defeating features — and each platform licence is issued per company after a short KYC step.
From signed scope to verified fix
The workflow you see in every engagement. Re-runs compare against the last assessment and report what changed.
- Step 1
Authorize & scope
You sign the scope — the in-scope assets, the window, the named approvers. We lay out which agents run against which assets, and you approve the exact plan before anything starts.
- Step 2
Discover & analyze
Non-intrusive discovery of your attack surface, then vulnerabilities, misconfigurations and exposures — correlated and de-duplicated into one clean list.
- Step 3
Validate the real ones
Scored by business risk, and — where you authorize it — confirmed with a single, non-destructive proof of concept and captured evidence. False positives removed.
- Step 4
Report, fix, re-test
Board and technical reports with the attack paths and the fixes. You remediate; we re-test and mark each finding verified, with the delta on the record.
Have us run it — or license the platform yourself
The same platform, four ways. Take it as a service we deliver, or license it directly: a per-company subscription for your own team, or a multi-tenant licence for an MSSP to run across its whole book of clients. Each licence is per-company, KYC-verified, and enforces the signed-authorization gate.
- Managed engagement Service
- A scoped, consultant-led red-team or penetration-test engagement — point-in-time or continuous — with the board and technical reports, the compliance view, and the re-test to prove the fixes landed. The usual way to start.
- vCISO-led programme Service
- Run as part of a vCISO engagement, so offensive testing feeds the same roadmap, risk register and board pack — with the deliberate separation that a tester should not assess controls they helped design.
- Company licence Subscription
- License the platform for your own security team to run internal detection and penetration themselves — a per-company subscription, under the same authorization gate and audit trail, with the continuous scheduler for always-on validation. Priced per company, not per seat.
- MSSP licence Multi-tenant
- A multi-tenant licence to run the platform across a portfolio of clients — tenant isolation, a REST API with role-based access, white-label reporting, and per-client usage metering. One licence covering a book of business.
Licences are issued per company after a short KYC step and carry the signed-authorization enforcement built into the platform — a safeguard for an offensive tool, and one your own auditors will want to see.
Where this is today
We would rather you hear this from us than find it in a demo. The buyer who reads this section carefully is the buyer worth having.
| Honest position | What that means for you |
|---|---|
| The platform is real and running | The control plane, the authorization gate, the recon agents, the scoring, the audit trail and the reporting are built and working — not slides. The AI pillar and detection validation are in. |
| It is early, and we are selective | We are taking a small number of engagements and design partners now, while identity, cloud and exploitation depth keep deepening. You get senior attention and influence over the roadmap. |
| Exploitation stays operator-licensed | The platform orchestrates, validates and evidences. Offensive payloads come from licensed, operator-supplied backends — we ship no exploit payloads. |
| Start non-intrusive, same day | The fastest way to see value is a non-intrusive assessment of your real external surface, authorized at Level 1–2. No access required, nothing touched. |
See it run against your own surface
A short call to confirm scope, then a non-intrusive assessment of your real external attack surface — authorized, safe by default, and yours to keep whether or not we go further.
Request a demo