Get in touch

OFFENSIVE LAB / INDEPENDENT RESEARCH

Pushing the boundariesof security research.

An independent lab powered by AI agents, dedicated to offensive, defensive and hardware experimentation.

Explore the researchView projects
Black panther with red accents on a mountain ridge

PROJECTS

Fregate
ATTACK SURFACE MONITORING
Air
OPERATOR CONSOLE
Kheish
PERSISTENT AGENT RUNTIME
Gateway
UNIFIED TOOL ENGINE

HOW THEY FIT

  • Air
    OPERATES
    Kheish

    Kheish runs the agents; Air is where you follow their runs, approve and answer.

  • Fregate
    SCANS THROUGH
    Gateway

    Gateway runs every check under scope; Fregate turns the results into exposures and changes.

FREGATE

See what an attacker sees, before they do.

Discover external assets, review exposures and track changes. Schedule scans through Gateway and route alerts to your team.

  • Discovery
  • Exposures
  • Changes
  • Alerts
Explore Fregate
Fregate Overview: 42 open exposures, 744 unreviewed changes, 39 assets pending review, 2 certificates to renew and 54,032 assets, with the exposures that need attention and the latest changes.Explore Fregate
The Overview of a workspace watching 54,032 assets: what needs attention first, and what changed.

Real screens from a demo workspace. Hostnames and addresses are replaced with documentation values, and third-party tool names are left out.

Air

Operate your agents, live.

Follow runs, handle approvals and questions, and manage stacks, schedules and channels from one console.

Air Overview: runs in the last 24 hours, what waits on you (a question and two approvals), runs over time and totals.Explore Air
The Overview: what waits on you, runs over time and totals, live from the daemon.

Real screens of Air on a local Kheish daemon, with demo sessions.

Explore Air
Kheish
OPEN SOURCE · APACHE 2.0

Agents that outlive the caller.

Run agents independently of the interface, with journaled sessions, human approvals and declarative stacks.

CLI, Air and channels feed the Kheish daemon, with journal, approvals and agent runs
Runtime architecture
Explore Kheish
Gateway

One engine. Typed results. Measured coverage.

Run reconnaissance and security checks through one scoped engine: subdomain discovery, port and service scans, web probing, crawling and vulnerability checks, each with typed results and measured coverage.

Explore Gateway
Tools run through Gateway scope and rate controls to produce typed observations and coverage

RESEARCH

Our research areas.