1 · Context
Profile the target and gather approved context: software, identity, infrastructure, controls, org policy and prior findings.
HOW IT WORKS
From hypothesis to proof to re-test.
0day Factory runs a disciplined investigation: it gathers approved context, proposes falsifiable attack hypotheses, tests them with execution you control, keeps only what it can prove, and re-tests after the fix.
Every finding is an evidence trail.
HYPOTHESIS
PATH
SAFE VALIDATION
EVIDENCE
ROOT CAUSE
OWNER
FIX
RE-TEST
What happens in an investigation.
2 · Hypotheses
Rank where attack paths are most likely and mint falsifiable hypotheses — each with an exact scope.
3 · Investigate
Test outside-in and inside-out, within approved scope, using execution the customer controls.
4 · Validate
Adversarially try to refute each candidate; safely confirm the ones that survive.
5 · Evidence
Capture the path, controls crossed or missing, the failed assumption, and a reproducible proof.
6 · Re-test
After the fix, re-run the original hypothesis and prove the path is closed.
Same investigation, two directions.
Outside-in tests applications, APIs, services and exposed infrastructure from the attacker-reachable surface. Inside-out uses approved internal context to investigate weaknesses surface-only testing can miss.
They are not two products. They converge into one attack graph and one evidence trail.
An empty result is a provable result.
The system is built to avoid false confidence. Candidates are adversarially refuted before they become findings, and every finding cites a real path with evidence.
When a wave comes back empty, it is demonstrably empty — not silently empty.
Questions, answered.
Who controls execution?
You do. Customer-controlled workers run scoped tasks near approved targets under your authorization, with evidence and audit. This execution layer is in Private Preview.
How do you avoid false positives?
Multi-lens adversarial refutation drops candidates that any lens can disprove, and surviving candidates are validated with evidence. Severity without proof is not a finding.
Prove which weaknesses can actually become attacks.
Request access and see a de-identified investigation: hypothesis, path, safe validation, evidence and re-test.