Loading…...
How the engine probes web apps and AI systems, grades responses against OWASP Web + LLM Top 10, and turns each finding into reproducible evidence and a suggested fix.
What the system sees
Only the request/response transcripts you authorize. Targets must match an explicit scope; out-of-scope endpoints are rejected before any probe runs.
Assumptions we make
Your endpoint is a black box. We do not require model weights, system prompts, or training data — only an authorized URL and credentials.
Signals we emit
Findings tagged with OWASP LLM IDs and MITRE techniques, conclusive per-category states when evidence permits, and, for eligible Starter+ runs, a checksum-verified evidence pack.
An aggregate coverage estimate plus category states and evidence status when the run is conclusive — enough to brief leadership without hiding per-finding nuance.
Canonical evidence, explicit assessment status, and stable schemas let engineering and security trace how each conclusive outcome was produced.
Remediation plans are prioritized and version-linked to the run that produced them. A human approves every change.
Probe corpora are versioned and evidence artifacts are checksummed. Because model and judge outputs may vary, reproduction requires the recorded corpus, target scope, configuration, provider/model version, and persisted outcome; it is never inferred from a prompt alone.
Historical lattice numbers come from research snapshot 57f15b67 (17 originals, 85 variants, four synthetic targets, five categories). The current product corpus has 32 probes across 10/10 categories at commit 8752ede; no current tenant or candidate rate is implied.