SUIDROOT
Continuous offensive testing that proves every action it took.
SUIDROOT is a penetration testing platform built for environments where autonomy alone is not enough. It plans and executes engagements against an authorized scope — reconnaissance, vulnerability identification, exploitation, and pivot analysis — while every action is checked against an approval policy before it runs and written to an immutable audit trail afterwards. Models run inside your boundary or against a commercial API, at your discretion.
A point-in-time pentest is stale the day it is delivered. Full autonomy is unacceptable on a federal network. SUIDROOT sits between the two.
An engagement begins with an authorized scope. From there SUIDROOT gathers hosts and assets, identifies vulnerability classes, and assembles what it finds into a live kill-chain graph that runs gathered → vulnerabilities → exploited → pivot. Nothing escalates on its own: each action is evaluated against the engagement approval policy, and anything beyond the configured impact threshold waits for an operator decision. Findings carry severity, CVSS, status, and a confidence level so triage separates confirmed from tentative. Every gate decision, session, and result is recorded in an audit log that can be exported for oversight, and the whole platform is tenant-scoped so programs never see each other.
Capabilities engineered for operators.
Engagements render as a navigable graph — gathered hosts, the vulnerabilities found on them, what was actually exploited, and where an operator could pivot next. A node inspector explains the evidence behind every edge, and the graph exports to draw.io, XML, PNG, or JPEG for reporting.
Every action is checked against the engagement approval policy before it runs. Deployment policy and impact classification determine what proceeds automatically, what requires an operator, and what is refused outright — enforced by the platform, not by convention.
Gate decisions, sessions, results, and operator actions are written to an append-only audit log. Oversight, inspectors general, and authorizing officials get a defensible record of exactly what was attempted against which asset and when.
Findings across every engagement in one view, filtered by severity, status, confidence, engagement, or assignee. Confirmed findings are separated from tentative, and false positives are tracked explicitly rather than silently discarded.
Eight built-in toolkits — Identify, Strings, Checksec, Symbols, Functions, ROP, Firmware scan, and Payload — operate on uploaded binary artifacts. Each run states its objective, records its analysis provider, and is checked against approval policy like any other action.
Analysis runs against a SUIDROOT-hosted local model inside your boundary, or against a commercial API where that is acceptable. The provider is selected per run, so sensitive engagements never depend on an external service.
Every view is tenant-scoped. Agencies, programs, and contract vehicles operate in the same deployment without sharing engagements, findings, assets, or audit history.
Autonomous sessions are observable, not opaque. Running, completed, and failed sessions are tracked with their outcomes so operators can see what the platform attempted and where it stopped.
A Model Context Protocol surface lets SUIDROOT drive external reverse-engineering and exploitation tooling through a governed interface, extending capability without loosening the approval model.
Access, approvals, deployment policy, and notification routing are administered per tenant, so who may authorize an escalation is a configuration decision rather than a tribal one.
From ingest to delivery — in minutes.
Define the engagement and its scope, set the approval policy, and establish the impact threshold above which an operator must decide. Nothing runs outside the authorized boundary.
Reconnaissance enumerates hosts, services, and assets within scope, establishing the first tier of the kill-chain graph and the technology fingerprint of each target.
Vulnerability classes are identified and attached to the assets that exhibit them, each carrying severity, CVSS where applicable, and a confidence level.
Candidate exploitation is submitted to the approval gate. Approved actions execute and the result — proven or refuted — is recorded with its supporting evidence, turning assumptions into confirmations.
Proven access is analyzed for onward movement. The graph surfaces the next targets an adversary would reach, so remediation is sequenced by real reachability rather than raw CVSS.
Findings, graphs, and the audit trail export for reporting and oversight. The record shows not only what was found, but what was attempted, what was gated, and who approved it.
Proven across the mission.
Continuous ATO Support
Replace the annual assessment with continuous evidence. Ongoing testing against an authorized boundary produces the artifacts authorizing officials need between formal assessments.
Red Team Augmentation
Let the platform carry reconnaissance, vulnerability identification, and routine proof work so cleared operators spend their time on the objectives that require human judgment.
Defense Industrial Base
Primes and subcontractors test their own environments continuously and hand the audit trail to a program office as evidence of ongoing diligence rather than a point-in-time claim.
Pre-Authorization Assessment
Exercise a system before it reaches an authorizing official. Findings arrive with proof of exploitability, so remediation effort is spent where reachability is demonstrated.
Oversight & Inspection
Inspectors general and independent assessors review an append-only record of every action taken against a network — the gap most autonomous tooling cannot close.
Disconnected Operations
Run the platform and its model entirely inside a closed enclave, so engagement data and findings never traverse a commercial boundary.
Built for networks where autonomy has to be accountable.
SUIDROOT is deployable from commercial cloud to a disconnected enclave, with the same approval model and audit guarantees in every configuration.
Full stack inside the customer perimeter with a locally hosted model. No engagement data leaves the enclave at any point.
Deployable into AWS GovCloud or Azure Government for US data residency and federal program alignment.
Standard cloud deployment for unclassified assessment work and commercial engagements.
SUIDROOT local LLM serving, so analysis and exploitation reasoning stay within the authorization boundary.
Optional use of commercial model APIs where policy permits, selectable per run rather than per deployment.
Per-engagement gating with impact classification, so low-impact analysis proceeds while escalation waits for a human.
Append-only audit history exportable for oversight, assessment packages, and incident review.
Programs, agencies, and contract vehicles share a deployment without sharing data, findings, or audit history.
See SUIDROOT run against your scope.
Bring an authorized target to a working session with Aegisbyte engineers. Live engagement walkthrough, approval-policy design, and air-gapped and classified deployment discussions available under NDA.