◆ Next live training: Red Blue Purple AI · Sep 1 & 3, 2026 · Attacking AI · Sep 22 & 24, 2026
ARMADA

We hunt the criticals your scanners can't.

The fleet finds it. An operator proves it.

A coordinated fleet of offensive agents sweeps your entire surface across recon, JS, API, and client-side. Then a skilled operator re-tests every lead and proves it. You get confirmed criticals with evidence attached, not a pile of unverified agent output.

How it works: ARMADA is a managed offensive engagement. You book it, the fleet runs your full surface, and an operator hands you verified findings.

// continuous offensive security · external pentest · attack-surface monitoring
Engagement
acme.comRUNNING
armada · fleet hunting acme.com
operator ~ $ armada engage acme.com --fleet 16   ▸ recon · 20 methods   apex · whois · asn · cert-transparency · dns   brute · permutation · object-storage · +12 more   → 63 apexes · 4,218 subs · 527 live hosts   ▸ js-analysis · 18-point methodology   endpoints · routes · secrets · source-maps   dom-sinks · proto-pollution · postMessage · cspt   → 9,418 endpoints · 31 secrets · 214 APIs   ▸ access-control IDOR/BOLA · BFLA · mass-assign · 2-acct sub ▸ api-auth JWT · OAuth · SSO · token forgery ▸ graphql introspection · batching · nested authz ▸ discovery-bypass 403-bypass · specs · SSRF · actuator ▸ client-side DOM-XSS · CSPT · proto-pollution     wave 7/13 · 16 agents concurrent   agent-04 ▸ partner-api.acme.com BOLA /business-partners/{id}   agent-11 ▸ leaderboard.acme.com inverted authz   agent-02 ▸ credit.acme.com unauth POST /token   agent-06 ▸ auth.acme.com credentialed CORS /oauth2/token   agent-09 ▸ ar-gallery.acme.com dangling CNAME → takeover   ▸ harness completeness ledger   197 runs · 123 populated · 44 thin · 30 hollow re-queued   ▸ proving it   GET /business-partners/418922 (no auth)   → 200 OK · 1,772,041 partner records ✓ CRITICAL · unauth API behind authed SPA   ▸ judge refuting candidates   → 219 finding-bearing hosts · agent-rated 11C / 70H   ▸ operator jhaddix   confirm 8 Critical · 12 High (triage 15%)   escalate agent-Info → CRITICAL (force-reset ATO)   fleet: 195 runs · 425/467 hosts (91%) · 219 with findings
Confirmed finding
Unauth IDOR exposes 1.77M partner records
CRITICAL9.8CWE-639
The fleet

One fleet. Four specialist modules.

ARMADA isn't a single scanner. It's a coordinated fleet of offensive modules, each owning a surface and running the same operator-verified loop. Buy the modules you need: one at a time, or the whole fleet.

ARMADA
OVERWATCH
Attack Surface & Recon

Maps your full external footprint before anything is tested, so nothing hides, twenty recon methods plus deep JavaScript mining.

  • apex, ASN & cert-transparency discovery
  • subdomain, permutation & object-storage sweeps
  • 18-point JavaScript & source-map mining
  • continuous attack-surface monitoring
  • and more…
agents · recon · cert-recon · js-analysis
On-demand · Continuous · scoped per targetScope →
WIDOW
Full-Stack Web & API

Deep testing across the entire web stack: server-side, API, and client-side. The complete access-control and auth suite plus every class of injection, chained into end-to-end exploits.

  • Server-side: SQLi, SSTI, command, XXE & SSRF
  • IDOR / BOLA / BFLA & mass assignment
  • JWT, OAuth, SSO, GraphQL & token forgery
  • 403-bypass & client-side (DOM-XSS, CSPT, proto-pollution)
  • and more…
agents · api-access-control · api-auth · client-side
On-demand · Continuous · scoped per appScope →
HERESY
Attacking AI Systems

Offensive testing for LLM apps, agents, and the infrastructure around them, against the attacks that actually break AI products.

  • prompt injection & jailbreaks
  • agent & tool-abuse chains
  • RAG data-exfil & system-prompt leakage
  • OWASP LLM Top 10 coverage
  • and more…
agents · llm-redteam · agent-abuse · rag-exfil
On-demand · Continuous · scoped per systemScope →
NETRUNNER
Internal Pentesting

Assumed-breach from inside the perimeter: measure blast radius, lateral movement, and how far a single foothold really reaches.

  • Active Directory & identity attack paths
  • lateral movement & privilege escalation
  • credential access & Kerberos abuse
  • blast-radius & detection-response mapping
  • and more…
agents · ad-recon · lateral · priv-esc
On-demand · Continuous · scoped per environmentScope →
The operator advantage

Agent scale. Operator judgment.

ARMADA is built like the model that actually won enterprise AppSec: a machine that works at scale, backed by operators who verify every finding before it reaches you.

✕  Push-button autonomy
  • Raw agent output, shipped unverified
  • Severity miscalibrated: routine issues inflated, chained criticals under-rated and silently dropped
  • ~1 in 7 runs fabricate completion: fake coverage that reads as "done"
  • You inherit the queue and triage the noise
✓  ARMADA · operator-backed
  • Every finding re-tested by a skilled operator and proven with captured evidence
  • Severity recalibrated both ways: over-rated Highs cut down, and the fleet's low and informational breadcrumbs escalated to the Criticals they really are
  • A machine-checkable completeness ledger catches hollow runs and re-runs them, giving provable coverage instead of a prose summary
  • Operators follow the fleet's leads, chaining low and informational breadcrumbs into criticals a scan would never connect
  • You get a verdict, not a backlog

The scanner + research-center model that defined enterprise application security, machine scale and human-verified, rebuilt for the era of autonomous agents.

Proven in every run

Real Findings.

A live sample of High and Critical findings ARMADA has proven across real engagements. Client domains and identifying details are redacted — the vulnerabilities are exactly what we found and verified.

CRITUnauthenticated IDOR → millions of PII records exposed
CRITOAuth authorization-code theft → full account takeover
CRITUnauthenticated SSRF → cloud metadata & credential theft
CRITpostMessage XSS → one-click account takeover
CRITGraphQL mutation IDOR → account takeover & profile hijack
CRITHardcoded OAuth client secrets in public JS → auth compromise
CRITDependency confusion → RCE via unclaimed npm scope
CRITIndirect prompt injection → data exfiltration via agent tools
CRITUnauthenticated API → full PII CRUD
HIGHCross-tenant BOLA → another customer's data
HIGHBroken function-level authz → unauthenticated employee PII
HIGHOAuth token exfiltration via unvalidated origin
HIGHLeaked API keys / tokens in client JS → backend access
HIGHSSO client database & endpoint disclosure
HIGHCORS arbitrary origin reflection → credential theft
HIGHPublic cloud bucket → database backup & token exposure
HIGHExposed internal admin panels & dashboards
HIGHDirect prompt injection → agent tool-schema exfiltration
CRITUnauthenticated IDOR → millions of PII records exposed
CRITOAuth authorization-code theft → full account takeover
CRITUnauthenticated SSRF → cloud metadata & credential theft
CRITpostMessage XSS → one-click account takeover
CRITGraphQL mutation IDOR → account takeover & profile hijack
CRITHardcoded OAuth client secrets in public JS → auth compromise
CRITDependency confusion → RCE via unclaimed npm scope
CRITIndirect prompt injection → data exfiltration via agent tools
CRITUnauthenticated API → full PII CRUD
HIGHCross-tenant BOLA → another customer's data
HIGHBroken function-level authz → unauthenticated employee PII
HIGHOAuth token exfiltration via unvalidated origin
HIGHLeaked API keys / tokens in client JS → backend access
HIGHSSO client database & endpoint disclosure
HIGHCORS arbitrary origin reflection → credential theft
HIGHPublic cloud bucket → database backup & token exposure
HIGHExposed internal admin panels & dashboards
HIGHDirect prompt injection → agent tool-schema exfiltration
CRITReflected XSS on login (redirect_uri) → session compromise
CRITLFI via malicious upload → cloud credential disclosure
CRITAuth-gate bypass via exposed JWT key → cross-user takeover
CRITUnauthenticated data-export API → bulk data exfiltration
HIGHMass assignment → privilege escalation
HIGHUnauthenticated /token issues live backend credentials
HIGHStored XSS in Dev Component Utility → persistent compromise
HIGHDOM XSS via unsafe markdown render
HIGHOpen redirect via javascript: handler → token theft
HIGHSubdomain takeover
HIGHBuild-time secrets baked into JS bundles
HIGHInternal automation platform → workflow logic & tokens exposed
HIGHCloud service_role JWT → privileged data access
HIGHWebSocket conversation hijacking via broken authz
HIGHSystem-prompt extraction via prompt injection
HIGHIndirect prompt injection via poisoned web content → agent hijack
HIGHRAG / retrieval injection → output manipulation
CRITReflected XSS on login (redirect_uri) → session compromise
CRITLFI via malicious upload → cloud credential disclosure
CRITAuth-gate bypass via exposed JWT key → cross-user takeover
CRITUnauthenticated data-export API → bulk data exfiltration
HIGHMass assignment → privilege escalation
HIGHUnauthenticated /token issues live backend credentials
HIGHStored XSS in Dev Component Utility → persistent compromise
HIGHDOM XSS via unsafe markdown render
HIGHOpen redirect via javascript: handler → token theft
HIGHSubdomain takeover
HIGHBuild-time secrets baked into JS bundles
HIGHInternal automation platform → workflow logic & tokens exposed
HIGHCloud service_role JWT → privileged data access
HIGHWebSocket conversation hijacking via broken authz
HIGHSystem-prompt extraction via prompt injection
HIGHIndirect prompt injection via poisoned web content → agent hijack
HIGHRAG / retrieval injection → output manipulation
The receipts

Methodology, encoded.

Not a model with a prompt. Exhaustive methodology-based agents that Map, Mine, and Exploit, built by our operators across careers of offensive security and red-team work. See some samples below...

Recon

20 methods
  • apex discovery
  • forward whois
  • reverse whois
  • ASN mapping
  • cert transparency
  • DNS records
  • scraping
  • brute force
  • permutation
  • vhost
  • favicon hash
  • historical
  • object storage
  • cloud assets
  • port scan
  • linked discovery
  • DMARC / SPF
  • AI attribution
  • CSP analysis
  • repository mining
  • and more…

JS Analysis

18-point
  • full JS collection
  • historical JS
  • source-map recovery
  • endpoint extraction
  • route extraction
  • REST mapping
  • GraphQL mapping
  • websocket mapping
  • secret / key sweep
  • JWT discovery
  • feature flags
  • DOM-XSS sinks
  • prototype pollution
  • postMessage
  • path traversal
  • storage gadgets
  • CSP bypass
  • dependency audit
  • and more…

API & Access Control

full suite
  • IDOR / BOLA
  • BFLA / MFLAC
  • BOPLA
  • two-account substitution
  • mass assignment
  • method switching
  • JWT forgery
  • OAuth / OIDC flaws
  • SAML / SSO
  • GraphQL abuse
  • 403 / 401 bypass
  • Actuator / heapdump
  • SSRF
  • cross-tenant
  • env-twin abuse
  • API-key reuse
  • and more…
↻  Every engagement sharpens the fleet, and the sharper fleet feeds the next engagement
Packaging

Buy the surfaces you need.

ARMADA is modular. Run a single module against one target, or deploy the whole fleet, on demand or continuously. Every finding is operator-verified before it reaches you.

On-Demand
// a single proven assessment

Point a module at a target and get back operator-verified, exploit-proven findings with evidence attached. Delivered as a polished HTML report. No standing commitment.

  • One module, one target
  • Coverage ledger proves what was assessed
  • Operator-verified, evidence attached
Continuous
// weekly, operator-verified

The fleet re-runs every week, so new exposure introduced as your apps and attack surface change gets caught within days, not next quarter.

  • Any modules, on a weekly cadence
  • Fresh re-test every week
  • Standing operator triage
Scope your engagement →

Transparent scoping: we'll size it to your targets and cadence and get right back to you.

How it hunts

One target in. A proven assessment out.

Point ARMADA at a domain. The fleet chains small primitives into end-to-end exploits a point-in-time scanner never finds, and a coverage ledger tracks every host until the engagement is provably complete.

Map Mine Exploit Triage Verify ↻ every host re-run until provably complete
I

Map

Twenty distinct recon methods map the full external surface: apex discovery, forward & reverse WHOIS, ASN, cert transparency, DNS, permutation, favicon, object storage, and more.

recon · cert-recon · subdomain
II

Mine

An 18-point JavaScript methodology reads every live and historical bundle for endpoints, routes, secrets, source maps and DOM sinks scanners never see.

js-analysis · dependency-audit
III

Exploit

The full access-control & auth suite, driven by the two-account method, not pattern-matched: IDOR/BOLA, BFLA, mass assignment, JWT and OAuth abuse, GraphQL, 403-bypass, and client-side.

api-access-control · api-auth · client-side
IV

Triage

An independent judge agent refutes every lead, killing the model's own false positives before a human ever sees them.

judge · pentest-report
V

Verify

A skilled operator re-tests every survivor on the live target, proves it with evidence, and recalibrates severity both ways: cutting over-rated Highs, and chaining the fleet's low and informational breadcrumbs into the criticals they really are. The human verdict is what ships.

◆ Human operator
What you receive

A verdict, not a backlog.

Every confirmed finding ships in the ARMADA report: proven, CVSS-scored, and remediation-ready. Nine sections per finding, written so an engineer can reproduce it and a board can understand it.

  • Non-technical summary
  • Business impact
  • Technical detail
  • Reproduction steps
  • Working cURL
  • Proof of exploit
  • Evidence files
  • Remediation
  • Triage consideration
  • CVSS + severity
ARMADA
CONFIDENTIAL · FINDING F-001
Critical · CVSS 9.8
Unauthenticated IDOR exposes 1.77M partner records
partner-api.acme.com · CWE-639 · Broken Access Control
Proof of Exploit
$ curl https://partner-api.acme.com/business-partners/418922
  (no Authorization header)
200 OK · 1,772,041 records returned ✓
JH
Jason Haddix
Founder, Arcanum · Operator-in-Chief

Creator of The Bug Hunter's Methodology, one of the most widely used approaches in offensive security. Jason and the Arcanum team have trained and tested the security programs of the biggest companies in the world. ARMADA runs their methodology, and a senior operator verifies every finding before it ships. The name on the work is a real one.

Questions

The things you're about to ask.

Is it safe to run against production?

Yes. Zero production incidents across every engagement to date. ARMADA proves a vulnerability exists without damaging the target, and it will never delete data or charge a card to demonstrate impact. Destructive verbs are held back by default, and every critical is human-verified before it is disclosed. That safety is engineered into the harness, not bolted on.

How long does an engagement take?

On wide-scope surfaces, the fleet assesses hundreds of hosts in days. In a recent 10-day deployment, that was 425 hosts. Operator validation runs alongside and is the deliberate, human part of the timeline.

Do you need accounts or credentials?

No. ARMADA runs every unauthenticated test first, then tells you exactly which findings need accounts for a second, authenticated pass. You can start with zero setup.

How is this different from a scanner, or from a fully autonomous tool?

Scanners pattern-match. Fully autonomous tools ship raw, unverified agent output. ARMADA reasons and chains like a human red-teamer, then a skilled operator verifies and recalibrates every finding before it reaches you. Proof attached, severity correct. Chains escalated.

What do I actually get at the end?

The ARMADA report: every confirmed finding in a consistent nine-section format with proof of exploit, CVSS, reproduction steps and remediation, plus a coverage ledger proving exactly what was assessed, all delivered as a polished, interactive HTML report.

Deploy the fleet

Point us at your perimeter.

Tell us about your target in the contact form and we'll get in touch to scope your engagement.

Book an engagement →