BBC News · Nov 2026EXHIBIT 00
Largest hack in history ($6.3bn) used fake job interviews and an AI tool
Co-CEO Richard Teng told CNBC hackers used fake job interviews and an AI tool. No zero-day. Just a convincing conversation.
A team of autonomous security agents that test your team with realistic phishing and deepfake simulations, and probe your app and codebase. Every slip becomes a short lesson, and every bug comes with a fix.
AI-powered human pentesting that breaks your weakest link..
Co-CEO Richard Teng told CNBC hackers used fake job interviews and an AI tool. No zero-day. Just a convincing conversation.
Attackers use AI every day, against your people and your code. Both deserve practice against the real thing.
Every offering below exists because of a breach that already happened. Each one is paired with its exhibit and what our agents would have tested before an attacker did.
Human error causes 60% of data breaches. Short, sharp lessons triggered by what each person might fall for, written for their role.
Attackers reportedly found an employee on LinkedIn and impersonated them to the help desk. MGM later disclosed around $100m in impact.
The “CFO” and colleagues on screen were AI-generated. Fifteen transfers later, roughly HK$200m was gone.
OpenAI’s executives joined what they thought was a call with Ukraine’s officials. It was two pranksters, who spent 17 minutes probing a $200m contract and uploaded the call online.
Hyper-realistic and personalised to each target. Our agents attack the way modern attackers do, across every channel your people trust.
AI writes more of your code every week, which makes the human reviewer the last line of defence. We test that line with realistic pull requests in your stack, seeded with flaws in AI-style code.
Speed went up. Scrutiny went down.
The Cl0p gang mass-exploited a SQL injection flaw in a file-transfer app. Airlines, broadcasters and government agencies were among the victims.
AI agents that find the holes in your code and your app before attackers do, prove each one, and suggest the fix. Use them inside the coding agent you already have, or let ours review every change you ship in an isolated sandbox.
Three steps, running on a loop, so you’re tested against today’s attacks, not last year’s.
Agents learn what an attacker would: who works where, what you expose, what your code looks like, strictly within the scope you sign off.
Personalised campaigns across email, voice, video, code review and your live web apps. All year round, not once a quarter.
People get a lesson in the moment. Engineers get validated findings with suggested fixes. Leadership gets one honest view of risk.
People modules are priced per person. Offensive security agents are priced per codebase, because that’s what they attack.
One people module of your choice.
All three people modules.
Our agents attack your code and your app.
Plugin, skills and MCP server with 15 security tools that make Claude Code or Codex a security engineer. Runs on your machine.
USD, excl. tax. [BILLING TERM]. No free plan, no free trial. Just a [GUARANTEE / REFUND POLICY].
Written rules of engagement for every target and channel.
Voices and faces are cloned only with opt-in.
We prove the door opens. We never take what’s inside.
Engineers review campaigns and can stop any agent instantly.
The questions people ask before they let our agents near their code. Something missing? Talk to us.
“Looks cool, but I’m a bit scared. The models are abliterated, and they’d have access to my stuff.”
Fair worry. Abliterated means it won’t refuse. It doesn’t mean it gets more access.
Abliterated just means the model won’t refuse to think like an attacker. It doesn’t get more access. Code scans run read-only in an isolated sandbox that’s deleted after every scan: no shell, no network, no writes, and it never runs your code.
No. Your repository is read inside the scan VM and deleted with it. We keep the findings and suggested fixes, not your codebase. Your code is never used to train any model.
The agent never pushes to your repo. Every fix arrives as a pull request with the finding and proof attached. Your team reviews it and decides whether to merge.
Web tests run in an isolated sandbox that can only reach the domain you’ve verified you own, and it’s deleted when the test ends. They follow the schedule and scope you set. Payloads are defanged, rate limits are respected, and you can pause any agent instantly.
Yes. Run the agents on your own infrastructure so your code never leaves your network. [SELF-HOSTING PLAN / PRICING]
A pentest is a snapshot of one week. You ship every day. Our agents retest on every deploy, so a new hole is found in hours, not at next year’s engagement.
AI-powered human pentesting that breaks your weakest link.