The open-source AI security agent.

Very. We find previously unknown vulnerabilities in software billions of people depend on, including the Linux kernel that powers Android phones and servers around the world. We collaborate with leading AI labs and defence organizations. You can read our public disclosures and inspect the fixes.

That’s Zero, by the way. Who said security had to look boring?

We’re an applied AI and cybersecurity research lab. Our managed security service brings that research to your code, dependencies and infrastructure. We handle the testing, verify findings and prepare fixes while your team keeps building.

Attackers are quick to adopt new technology. AI is no exception: it helps them investigate more targets, discover vulnerabilities and develop exploits faster. Security needs to keep pace with both the attackers and the software your team is shipping.

We put agents to work continuously, investigating attack paths and preparing fixes as your software changes. Recent incidents involving agents taking unauthorized actions also show why that power needs carefully designed infrastructure around it.

Your source code, dependencies, websites, APIs, apps, cloud infrastructure, operating systems and AI systems. We investigate how these parts connect, because an attack can start in one place and reach something much more valuable elsewhere.

Your web app is only part of the picture. Operating systems accounted for 44% of exploited zero-days (2025), making them the largest category. Your security needs to reach the software underneath your application, too.

Yes. Our managed service includes white-box, grey-box and black-box pentesting across your full stack. We agree the targets, access and testing depth with you, then handle the investigations, verified findings and fixes.

We know your engineers already have plenty on their plate. We prioritise findings by business impact and prepare verified fixes as pull requests, ready for your team to review and merge.

That saves your developers time investigating issues and writing fixes, so they can spend more of it building.

We handle testing in the background and bring verified findings and fix PRs into the tools you already use. You don’t need to watch a dashboard or start scans manually.

We agree the scope, schedule and approvals with you. Your team stays in control of access and which changes are merged.

Agents do the security work: planning investigations, exploring attack paths, writing tools when they need them and preparing fixes. We select models for different tasks, and agents combine their findings.

The entire workflow is built around delegating that work, from investigation to repair. You shouldn’t have to supervise every step to get a useful result.

You get the research, models and security testing tools behind our discoveries in software billions of devices and governments rely on. Real attack paths and verified findings guide new investigations. Our public disclosures and upstream fixes let you inspect the work behind the service.

Yes. We connect the managed service to your repositories, CI/CD pipeline and delivery workflow. PR reviews, releases, pushes and custom schedules can trigger the agreed work. Verified findings and fix PRs arrive where your engineers and coding agents already work.

Tests run in fresh, disposable virtual-machine sandboxes, isolated at the virtualization layer. Runs have time limits, and the sandboxes are torn down afterwards.

We agree testing scope, access and approval controls before work starts. Your team keeps control over what gets tested and which changes are applied.

Yes. You set the scope, budget and where approvals are required. Agents carry out the work without needing someone to direct every step.

Your team can review the evidence and fix PRs, require approval before changes are merged, and track what was tested and changed. We work with you on deployment requirements and how the service fits your existing processes.

The open-source harness is free to inspect, run and extend with your own models and tools. We’re setting a new standard for transparency in the security industry: you can inspect the engine behind the service and the public research behind our findings.

The managed service turns that foundation into continuous security testing tailored to your business. We handle setup, infrastructure, frontier cyber models and ongoing testing. We verify findings and fixes in isolated sandboxes and deliver the results through your workflow. Your team gets the benefit of our research without having to build and operate the system themselves.

Yes. We provide testing evidence and reports for your SOC 2 and ISO 27001 work, alongside board reporting. We agree the reporting requirements with you when scoping the service.