Not just another tool.An AI security operator.
Braintruder runs methodology-led penetration tests against your real surface - hypothesising, probing, and capturing evidence like a seasoned operator, then turning it into a clear, prioritised report your team can act on. No specialist offensive expertise required, at a fraction of the cost and wait of a traditional engagement.
Built around the work, not the dashboard.
Braintruder behaves like a member of your security team - methodical, transparent, and accountable for what it does.
A scanner flags. Braintruder investigates.
Vulnerability scanners match signatures and hand you a list. They can't tell you which of those findings an attacker could actually reach, chain, or exploit - and a clean scan only means nothing matched, not that you're safe. Braintruder starts where a scanner stops.
Deterministic baseline
An optional scripted sweep - the same tools and coverage a careful pentester runs first, repeatable on every run. Run it on its own, or let it seed a full AI pentest with a ready-made picture of the target.
AI investigation
Braintruder treats those results as leads, not conclusions. It forms hypotheses, corroborates each one against real evidence, stays inside your scope, and discards what doesn't hold up - the judgement a scanner has no way to apply.
Proven, not padded
Confirmed findings ship with the command that proved them. CVE mentions are validated against NVD and OSV, and anything unverified is labelled as such. We would rather report the truth than inflate the count.
Watch a real methodology, not a marketing reel.
Braintruder narrates its work as it goes. You see the hypothesis, the probe, the evidence, and the next decision - the same way a thoughtful operator would walk you through it.
- Transparent reasoningEvery step is logged with intent, target, and outcome.
- Approval gatesHigher-impact actions pause for an operator to confirm.
- Replayable evidenceFindings ship with the artefacts that proved them.
Capabilities shown are illustrative. Braintruder is evolving rapidly - get in touch for the current scope of supported methodologies and integrations.
Designed for IT teams. Built for operators.
A workspace that makes a complex methodology feel obvious. Findings, evidence, and remediation in one place.
- CRTCross-tenant access via X-Tenant-ID rewrite
- CRTUnauthenticated SSRF on /api/render
- HGHStored XSS via display-name field
- HGHIDOR on /v2/invoices/{id}
- MEDJWT signed with HS256 + weak secret
- 14:02Recon - discovered 14 subdomains across 3 providers.
- 14:07Mapping - auth model: JWT (HS256). Flagged for review.
- 14:11Hypothesis - tenant boundary may be header-controlled.
- 14:14Validated - cross-tenant access reproduced (3 captures).
- 14:16Approval - operator gated next step. Awaiting confirmation.
- 14:24Drafting - reproduction steps and remediation guidance.
Graded against the standards you're measured on.
Once the pentest is done, you answer a short structured questionnaire about your policies and controls. Braintruder's policy-comparison stage then weighs the technical findings against what you've said you already do - so nothing is judged in a vacuum. The result grades the whole picture: where reality matches policy, and where it doesn't.
- Policy-aware findingsTechnical results are weighed against the controls you told us you run - surfacing the gap between what's written down and what's actually true.
- Framework-taggedEach finding carries its Cyber Essentials / ISO 27001 / CIS relevance, so the report already speaks your assessor's language.
- The full pictureNot just “is this exploitable”, but “does your posture hold up against the standard you're claiming”.
- A.9.4.1 · Access restrictionGap found
- CE · Secure configurationAligned
- A.12.6.1 · Vulnerability mgmtPartial
- CE · User access controlAligned
Questions, answered.
How is Braintruder different from a vulnerability scanner?
A scanner matches signatures and hands you a list - it can't tell you which findings an attacker could actually reach or exploit, and a clean scan only means nothing matched. Braintruder investigates: it forms hypotheses, corroborates each one against real evidence, discards what doesn't hold up, and reports only what it can prove.
Does Braintruder include its own vulnerability scanner?
Yes. It has an optional deterministic baseline scanner that runs the same tools a careful pentester would run first. You can run it standalone, let it seed a full AI pentest, or schedule it to sweep your estate on a cadence with drift detection and one-click escalation to a full engagement.
Which compliance frameworks does Braintruder support?
Findings are graded against Cyber Essentials, Cyber Essentials Plus, and ISO 27001:2022, with severity scored on CVSS and engagements following OWASP WSTG methodology.
Do I need penetration-testing expertise to use it?
No. Braintruder is built for IT teams and operators without specialist offensive expertise - you configure the target, run the engagement, and read a clear, prioritised report.
Is it safe to run against real systems?
Guardrails are on from the first command and any higher-impact action pauses for your explicit sign-off, so nothing runs behind your back.
How does the compliance grading work?
After the pentest, a short structured questionnaire captures your policies and controls. The policy-comparison stage then weighs the technical findings against what you've said you already do - grading the full picture, where reality matches policy and where it doesn't.
Ready to understand your real security risk?
Book a working session with our team. We'll walk through your environment, scope an engagement, and show you what evidence-backed assurance looks like.