Every finding proven before you see it.
nitsec runs autonomous agents that test your applications the way a penetration tester would, then reproduces every finding before it reaches you and delivers a signed report with replayable proof. Continuously. On demand.
This is what lands in your portal.
Not a scanner's alert stream — a validated set, each finding graded and carrying the exact traffic that proves it.
account_id is taken straight from the URL and the statements are returned without checking the account belongs to the signed-in customer.GET /api/v2/accounts/50318/statements for an account A does not own → the response returns that account's statements in full.account_id before returning it.the findingClass and category by name, the reproduction in full, the impact and the fix — and the raw request/response sequence that proves it, replayable on demand with the negative control attached.
the setThe count is findings, not noise. A low that could not be reproduced carries an unvalidated badge instead of being hidden or inflated — you see the engine's honesty, not just its hits.
the loopClosing a finding is proof, not a checkbox. A retest re-runs the finding's own recorded exploit against the change — the 403 where there was a 200 is the evidence.
Scope in. Signed report out. The loop stays closed.
A hunt is one autonomous engagement end to end: it maps the attack surface, tests through a recording proxy as your own principals, validates what it finds, and delivers.
Authorize
Assets and rules of engagement, verified and locked.
Test
Agents probe each surface, signed in as real principals.
Prove
Each candidate reproduced and graded. Unproven ones dropped.
Deliver
Risk-rated findings, evidence, remediation, coverage.
Confirm
Ship a fix, get a verdict by replay — in minutes.
A report your team can act on the hour it lands.
Validated, not alerted
An independent pass reproduces every finding before delivery. You triage findings, never a scanner's backlog of maybes.
Severity you can defend
Impact is rated on what was actually demonstrated, on the CVSS scale — not pushed up a tier to look impressive.
Proof that replays
Each finding carries its real request and response traffic, masked for safety and replayable on demand. Verify it; hand it to a developer as a reproduction.
Fix it, then prove the fix
Request a retest and nitsec re-runs the finding's own exploit against your change and returns a verdict in minutes — not a new engagement.
Nothing out of scope
Scope and rules of engagement are enforced around every run. A host you did not authorize is never reached.
Continuous & on demand
Run on a schedule or on a deploy. A point-in-time pentest is obsolete the next commit; this keeps up.
See a hunt run on your own target.
Create an account and point nitsec at a staging target, or email us for a walkthrough and watch a finding reproduced in front of you. Walkthroughs take about thirty minutes.