How it's built
Architecture, source, services, infrastructure, dependencies and trust boundaries.
PLATFORM
One investigation across your whole security reality.
An exploitable path rarely lives in one scanner. 0day Factory reasons across software, infrastructure, identity, security controls, organizational constraints and runtime behavior to discover and prove exploitable attack paths — then re-tests the fix.
The path crosses every layer. So does the investigation.
0day Factory investigates the relationships between the layers attackers actually chain — not one surface at a time.
SOURCE
APP / API
IDENTITY
INFRASTRUCTURE
SECURITY CONTROLS
RUNTIME
EXPLOIT PROOF
FED BY: ORG RESTRICTIONS · SECURITY DNA · PRIOR FINDINGS · THREAT MODELS · EXCEPTIONS
Your organization has security DNA. Use it.
Better models make hypotheses cheap. They do not know your architecture, identity relationships, controls, standards, exceptions, tenant boundaries or remediation history. That context is the moat.
How it's secured
Security controls, SDLC rules, internal standards, threat models and approved exceptions.
What actually happens
Runtime behavior, reachable paths, exploit evidence, past findings and remediation outcomes.
The goal isn't another alert. It's a defensible answer.
Can this path actually be exploited here? Every finding answers attacker outcome, exact path, controls crossed or missing, the failed assumption, the proof, the engineering fix, and the re-test result.
HYPOTHESIS
PATH
SAFE VALIDATION
EVIDENCE
ROOT CAUSE
OWNER
FIX
RE-TEST
Run research where your systems live.
Customer-controlled workers execute explicitly scoped tasks near approved targets. The control plane manages authorization, task boundaries, evidence and auditability: 0DF CONTROL PLANE → SCOPED TASK → CUSTOMER WORKER → APPROVED TARGET.
Scope, identity, TTL, network boundary, approval mode and evidence retention are all explicit. This capability is in Private Preview — it is labeled as such until it is production-ready.
Autonomy that stays in scope.
Scope enforcement
Targets come from the engagement record; out-of-scope targets are refused.
Identity & least privilege
Separate agent identities, short-lived scoped credentials, non-admin roles.
Organizational policy
Prohibited actions, data-access limits and approval boundaries are honored.
Evidence & audit
Every action is recorded — the engagement's evidence of authorization.
Human control
Approval gates where you want them; cancel at any time.
Tenant isolation
Database row-level isolation keeps each tenant's work separate.
Questions, answered.
Is 0day Factory another AI pentester?
The category label fits, but the emphasis is different: full-system context and defensible exploit proof, not another alert generator. Penetration testing is a use case, not the identity of the product.
What is Available today vs Planned?
The product surface — multi-tenant workspaces, findings, triage, evidence and coordinated-disclosure export — is Available. Customer-controlled execution is in Private Preview. Capabilities are labeled Available, Private Preview or Planned; nothing is implied production-ready before it is.
Prove which weaknesses can actually become attacks.
Request access and see a de-identified investigation: hypothesis, path, safe validation, evidence and re-test.