AUTONOMOUS
Autonomous pentesting · Applications & networks

Vordask

An AI system that runs the pentest itself — web applications, internal networks, Active Directory, WLAN.
Every finding is re-staged before it reaches the report. Reporting follows BSI methodology.
The models run locally. No cloud service sees your data.

// The box: in development · Pentests: bookable now
// Request a pentest What gets tested
0
Cloud AI in the test
100%
Local models
BSI
Reporting standard
1:1
Every finding re-staged
Status

Bookable today.
Soon in your rack.

Available now · the pentest
  • Web applications, internal networks, perimeter, Active Directory, WLAN.
  • Vordask tests autonomously. I check every result and stand behind it.
  • Reporting as an IS penetration test report to BSI structure.
  • Models run locally — no cloud AI service gets to see your data.
In development · the box
  • The same software as a device in your rack.
  • Test as often as you like — without anything leaving your network.
  • Even where there is no route out at all.
  • The licence stays with you.
  • Book a pentest and you get it at a preferential rate.

The two go together. The box is the goal, the pentest is the way there. Book today and you get a full test — and a say in what the box has to run on first.

What it finds

Built for what
scanners walk past.

01
Logic flaws
Steps that are each permitted and together produce something nobody wanted.
02
Somebody else’s data
Who sees data that is not theirs — across users, roles and customers.
03
Paths through the network
What is reachable from inside, and how far a compromised account gets.
04
Proven, not guessed
What cannot be re-staged does not go in the report.
First result

Two flaws.
Both proven.

An analytics dashboard with two hidden vulnerabilities, behind a login, on its own machine on the network. Vordask found both by itself.

One was code execution through a formula field — stored in one request, executed only when the report is rendered. The other was access to another tenant’s data. Both logic, neither a known pattern.

Write-up to follow.

// MetricFlow — analytics dashboard, separate host, same LAN
accessbehind a login
 
[01] RCE — stored formula
   classeval injection · CWE-94
   chainstored, then run at render
   statusexploit successful
 
[02] IDOR — /users/:id
   classbroken object-level auth · CWE-639
   statuscross-tenant records reached
 
cloud services in the testnone
// write-up to follow
Why now

The reason changes.
The duty stays.

NIS2, DORA, GDPR, a customer questionnaire, or a release that changed how permissions work. What all of them want: test regularly, and be able to prove it.

// What the report covers
Request

See what
they miss.

Tell us briefly what needs testing. You get an answer either way.

// Request a pentest