Loading…...
How the engine probes web apps and AI systems, grades responses against OWASP Web + LLM Top 10, and turns each finding into reproducible evidence and a suggested fix.
What the system sees
Only the request/response transcripts you authorize. Targets must match an explicit scope; out-of-scope endpoints are rejected before any probe runs.
Assumptions we make
Your endpoint is a black box. We do not require model weights, system prompts, or training data — only an authorized URL and credentials.
Signals we emit
Findings tagged with OWASP LLM IDs and MITRE techniques, a per-category coverage score, a brittleness flag, and a signed evidence pack.
One coverage number per OWASP category and a clear bypassed / refused / validated breakdown — enough to brief leadership without losing the per-finding nuance.
Findings carry deterministic rubrics so engineering and security read the same outcome from the same transcript.
Remediation plans are prioritized and version-linked to the run that produced them. A human approves every change.
The probe corpora are version-locked and the synthesis is deterministic, so any finding can be reproduced from the versioned artifacts. Methodology notes live in the repo.
Numbers in the lattice come from our internal brittleness baseline; tenant-specific reproductions require running the engine against your own endpoint.