Outside-in
Test applications, APIs, services and exposed infrastructure from the attacker-reachable surface — scoped to the approved engagement.
AUTONOMOUS SECURITY RESEARCH
Find the attack pathyour scannerscan’t see.
0day Factory reasons across code, applications, infrastructure, identity, security controls, organizational constraints and runtime behavior to discover and prove exploitable attack paths — then re-tests the fix.
+ BLACK-BOX + WHITE-BOX · EVIDENCE-BACKED · CUSTOMER-CONTROLLED EXECUTION↓
01 / YOUR SECURITY REALITY
An exploitable path rarely lives in one scanner.
0day Factory investigates the relationships between software, infrastructure, identities, controls and the rules unique to your organization.
SOURCE
APP / API
IDENTITY
INFRASTRUCTURE
SECURITY CONTROLS
RUNTIME
EXPLOIT PROOF
FED BY: ORG RESTRICTIONS · SECURITY DNA · PRIOR FINDINGS · THREAT MODELS · EXCEPTIONS
02 / ONE INVESTIGATION
Outside in. Inside out. Same investigation.
Inside-out
Use approved internal context — source, architecture, identity, infrastructure, controls, policy and prior findings — to investigate weaknesses surface-only testing misses.
One attack graph
Both directions converge into a single attack graph and evidence trail — not two disconnected products.
03 / CONTEXT IS THE MOAT
Your organization has security DNA. Use it.
How it’s built
Architecture, source, services, infrastructure, dependencies and trust boundaries.
How it’s secured
Security controls, SDLC rules, internal standards, threat models and approved exceptions.
What actually happens
Runtime behavior, reachable paths, exploit evidence, past findings and remediation outcomes.
The goal is not another list of alerts. It is a defensible answer to: can this path actually be exploited here?
04 / HYPOTHESIS → PROOF → RE-TEST
Every finding is an evidence trail.
HYPOTHESIS
PATH
SAFE VALIDATION
EVIDENCE
ROOT CAUSE
OWNER
FIX
RE-TEST
ATTACKER OUTCOME · EXACT PATH · CONTROLS CROSSED/BYPASSED/MISSING · FAILED ASSUMPTION · PROOF · ENGINEERING FIX
05 / INSIDE THE WORKSPACE
Real product. Real evidence.
Organize work by company, project and investigation. Review findings, confidence and the evidence behind each path in one workspace.
Explore the research workspace
DEMO WORKSPACEIllustrative data · no customer information
Example organization Application security API review Private engagement
01 / RESEARCHPRODUCT WALKTHROUGH
Every investigation has a trail.
Review the authorization boundaryAPI service · source review · scoped access
In reviewauthorization.ts Read-only source context
18 // Check access to the requested resource
19 const resource = await loadResource(id);
20 await authorize(user, resource.owner);
21 return serialize(resource);06 / CUSTOMER-CONTROLLED EXECUTIONPRIVATE PREVIEW
Run research where your systems live.
Customer-controlled workers execute explicitly scoped tasks near approved targets. The control plane manages authorization, task boundaries, evidence and auditability.
EXPOSE: SCOPE · IDENTITY · TTL · NETWORK BOUNDARY · APPROVAL MODE · EVIDENCE RETENTION
0DF CONTROL PLANE
SCOPED TASK LEASE / OUTBOUND ONLY
Customer workerRuns near approved targets
Approved targetIn authorized scope
CUSTOMER-CONTROLLED / AUDITABLE EXECUTION
07 / AUTONOMY INSIDE EXPLICIT BOUNDARIES
Autonomy that stays in scope.
Scope enforcement
Targets come from the engagement record; out-of-scope targets are refused.
Identity & least privilege
Separate agent identities, short-lived scoped credentials, non-admin roles.
Organizational policy
Prohibited actions, data-access limits and approval boundaries are honored.
Evidence & audit
Every action recorded — the engagement's evidence of authorization.
Human control
Approval gates where you want them; cancel at any time.
Tenant isolation
Row-level database isolation keeps each tenant's work separate.
08 / THE PROOF WE HOLD OURSELVES TO
Measured on certainty, not volume.
We publish verified numbers and de-identified case studies as engagements complete — never invented metrics. These are the dimensions that matter.
Validated attack paths
Paths independently proven exploitable in a real environment.
% missed by existing tooling
Novel chains that scanners and existing tools did not surface.
Fixes re-tested
Fixes re-run against the original hypothesis and confirmed closed.
Median hypothesis → proof
How fast an investigation reaches reproducible evidence.
09 / RESEARCH
From the lab.
Your Repository Is Executable Input Now
Coding agents changed the repository threat model: configuration, hooks, instructions and tool definitions can influence privileged agent behavior.
Read
MCP Is Becoming a Security Boundary. Treat It Like One.
MCP security is not mainly a prompt-filtering problem. Once an agent can call tools with real credentials, the useful threat model is identity + authorization + untrusted input + execution.
Read
Cloud Context Is Not Enough: Security Testing Needs the Organization's DNA
Real attack paths cross code, identity, infrastructure, controls and organization-specific rules. Product security needs a full-system model.
ReadProve which weaknesses can actually become attacks. In your environment.
Private access for invited teams.