DA1MON by PWNONEA pentester watching over your company all year round
Instead of hiring your own specialist or waiting for a once-a-year audit, you get a swarm of AI agents that keeps looking for a way into your infrastructure. Every finding is confirmed by a PWNONE pentester before it reaches you, so what you get are verified weaknesses, not a pile of alerts to dig through yourself.
$ da1mon --target=your_infrastructure // You own it, we pwn it.
Before any testing starts we verify the company, the scope and the right to act on the infrastructure in question.
In the tests run so far, DA1MON has meaningfully shortened reconnaissance and the work of mapping an environment. How much it shortens a full penetration test is still being measured, so we are not quoting figures yet. Multi-stage, evidence-based verification cuts down false alarms before the report.
This is not another vulnerability scanner
A scanner runs a list of predefined checks and leaves you with hundreds of alerts to review. DA1MON is a team of cooperating agents that imitates part of a pentester's reasoning: it gathers information, draws conclusions from it and decides for itself what to check next.
An ordinary scanner
- Runs a set of predefined checks
- Returns a large number of possible results
- Does not develop new paths on its own
- Requires alerts to be reviewed by hand
DA1MON
- Breaks the task into smaller actions
- Works on many paths in parallel
- Uses reconnaissance data to build the next hypotheses
- Chains individual weaknesses into real attack paths
- Sets the order of next steps
- Passes results to a pentester for verification
- Delivers confirmed findings together with the supporting evidence
Manual test (unassisted)
- A fixed time box, usually several days to a couple of weeks
- One or two people per project
- High cost of expert hours
- A snapshot from a single moment, out of date quickly
- Tedious recon and enumeration eat an expert's time
- Some assumptions are never checked
DA1MON removes the need to build your own offensive team. The repetitive work is done by the swarm, and a PWNONE pentester watches over the result, so there is nobody to put on the payroll.
When this tool is for you
DA1MON is not the answer to every need. Below are the situations where continuous testing genuinely changes the security picture, and the ones where a classic audit is enough.
- You ship to production more than once a month but check security once a year
- You have more systems than can be tested properly in a single annual audit
- You want to hear about a new vulnerability within weeks, not at the next audit
- You want findings confirmed by a pentester rather than a list of alerts to verify yourself
- You build your own software and can share the code for analysis
- You treat security as a process, not as an event once a year
And when a classic pentest is enough
We will say so plainly during the call rather than push a subscription on you.
- You need a one-off report for certification or to satisfy a counterparty
- The environment is stable and changes a few times a year
- The scope is narrow: one application, one date, one report
The fact graph is the basis of the whole process
DA1MON first gathers information about a host, a domain, an application or a network and arranges it into a fact graph. Only then does it develop attack hypotheses, grounded in what can actually be seen rather than guessed. The graph grows with every verified path, so reconnaissance is not a one-off start but something that comes back whenever a new asset appears.
Continuous Penetration Testing: the fact graph and the attack paths grow and are verified as the engagement runs, over weeks or months where the infrastructure is large. The report is a living document: it grows with every validated path rather than appearing only at the end. The knowledge base learns from exploitation, but globally we store only generalised techniques validated in the lab; raw findings stay in the client's own memory. Before every action the code checks the scope, and anything risky only proceeds once the pentester and the client approve it.
Orchestration
Runs the whole engagement and distributes work across the other agents.
Reconnaissance
Scans, detects services and performs content discovery. This is the starting point of the whole process.
Asset analysis
Builds the fact graph (assets, services and the relations between them) on which the next hypotheses are formed.
Developing hypotheses
Builds possible attack paths from information that has actually been found.
Prioritisation
Orders the work by potential impact and likelihood of success.
Scope enforcement
Enforces the scope on every tool call. Code decides that the swarm stays inside what you approved, not the model's judgement.
Verification against evidence
Tests hypotheses against evidence, discards what cannot be confirmed and removes false alarms.
Material for the pentester
Assembles evidence and context so a human can quickly confirm or reject a finding.
What working with DA1MON looks like
Eight stages from request to report. On two of them the decision is yours.
Defining the scope
You fill in a form covering your infrastructure, applications and the scope you expect. The questionnaire adapts to your earlier answers, so we come back to you with follow-up questions less often.
Scope verification
You and a PWNONE pentester both confirm the scope. The engagement starts only once both sides agree.
Reconnaissance
DA1MON identifies assets, services, endpoints and potential attack surface.
Fact graph
DA1MON arranges the assets, services and their relations into a fact graph. That graph, rather than a flat list, is what the next paths are built on.
Developing paths
The agents create and prioritise attack hypotheses based on the fact graph.
Safe execution
Safe actions run automatically. Anything that could affect system availability waits for approval from the pentester and from you.
Verification by a pentester
A pentester confirms or rejects every potential finding.
Report
You receive verified vulnerabilities, evidence, a risk score and everything needed to reproduce the problem.
Not every action runs automatically
DA1MON separates safe actions from those that could affect your environment. The latter wait for a decision.
Runs automatically
- Baseline reconnaissance
- Service enumeration
- Searching for files and directories
- Analysis of available shares
- Actions that do not affect the availability of the environment
Requires approval
- Password spraying
- Installing tools on a host
- Actions that may trigger EDR or antivirus
- Exploitation that could bring a service down
- Tests that could affect system availability
What you see before deciding
- Planned action
- Potential risk
- Possible benefits
- PWNONE recommendation
- Estimated token usage
- An approve or reject button
For the riskiest actions we use double approval: first a PWNONE pentester signs off, then you as the client.
Client panel and the pentester panel
You watch progress and verification status. The people supervising the test work in a separate view.
Client dashboard
- Scope of the active test
- Assets discovered and paths under analysis
- Current findings and their verification status
- Threat level and the pentester's recommendations
- Token usage
- Actions waiting for your decision
Operator and pentester panel
- Checking agent activity
- Approving the test scope
- Analysing hypotheses
- Confirming findings and dismissing false alarms
- Approving higher-risk actions
- Adding comments to the report
Finding statuses
Instead of a percentage of work done we show the state of every finding. The number of possible paths can grow during the engagement, because DA1MON keeps discovering new assets.
What you get at the end
Every finding rests on facts and comes with the material needed to trace and reproduce the problem.
Confirmed findings
Vulnerabilities backed by evidence and confirmed by a pentester, not hypotheses or a raw list of scanner alerts.
Risk classification
A Critical/High/Medium/Low rating in the context of an attack path, not in isolation. The same finding, used as a link in the chain to take over an admin account, is critical rather than „medium".
Supporting evidence
Evidence confirming the vulnerability and a step-by-step description of how to reproduce it.
Remediation recommendations
Concrete actions to take, ordered by priority.
A report verified by a human
A technical report for your team and an executive summary for the board. The engagement is led by a certified PWNONE pentester who is accountable for its contents.
Repeatable testing
After changes to the environment you can check whether the problem has come back.
How it is deployed depends on the type of test
To begin with we focus on the three most common cases.
External network and web applications
We run the test from PWNONE infrastructure, once the scope is agreed and our addresses are added to your allowlist.
Internal network
This usually calls for a virtual machine connected to your network with the right visibility configured. In selected cases we supply a physical device.
Source code analysis
You give us access to the repository or hand over the code in an agreed way. This gives deeper insight than testing from the outside: weaknesses are visible in the code before they can be exploited.
Your infrastructure changes daily
A one-off test describes the state of an environment on a single day, and the infrastructure keeps changing afterwards. A subscription checks it exactly when it actually changes.
This applies in particular to software houses, software vendors and organisations whose infrastructure changes regularly.
When it is worth checking the environment continuously
- You ship new code regularly
- You develop an application as SaaS
- You are adding new endpoints
- You are replacing hardware
- You are migrating domains
- You are changing the configuration of the environment
- You are expanding the infrastructure
- You fixed a vulnerability and want to check it has not returned
Choose an engagement model
We bill on a subscription that includes a pool of tokens for the agents' work. Start with a free trial and we will pick the plan after a conversation about your environment.
The figures shown are starting prices. The detailed scope, the number of available operations and the size of the token pool are agreed after we analyse the client's environment.
Start
An entry point into automated reconnaissance for a single application or service.
- Reconnaissance run by the agent swarm
- A client dashboard showing the test as it runs
- Scope as a single source of truth
- Verification of findings by a pentester
Pro
Continuous verification for infrastructure that changes regularly.
- Everything in the Start plan
- Consultations with a pentester
- Repeat tests after changes to the environment
- Direct contact with a PWNONE operator
- Handling of higher-risk actions on approval
Enterprise
For organisations with extensive infrastructure and compliance requirements.
- A dedicated pentester leading the work
- Internal network testing
- Confidentiality arrangements and an NDA
- Support with audits and compliance
Try DA1MON for free
Try the swarm on your own environment before committing to a subscription. The trial scope is agreed together, exactly as with a full test.
Claim a free trialNot sure which plan to pick?
Talk to a pentester. After a short conversation about your environment we will tell you what makes sense and what is not worth starting yet. No obligation.
Talk to a pentester RoadmapWhat works today and what is planned
We separate the two clearly so there is no doubt. We are at stage 1 of 3: this one is live and working on real engagements. The other two are being built or are on the roadmap.
Operational core
Live today- Agent orchestration
- Reconnaissance
- Basic hypotheses
- Automatic validation of selected results
- Pentester involvement
Extended analysis and exploitation
In progress- Static code analysis
- Extended specialist agents
- Chaining weaknesses into attack paths
- Developing and comparing a larger number of paths
- Searching for available exploits
- Patch difference
- Extended enumeration once a foothold is gained
- Analysis of specific hosts and accounts
Continuity and learning
Planned- Hypotheses from protocol specifications (RFC) and anomaly detection
- Recurring tests and retests
- Watching for changes and spotting regressions
- Memory of the client environment between tests
- A living report kept up to date
- A technique library that learns from exploitation and is validated in the lab
Before you ask
Will DA1MON replace a pentester in my company?
Yes, in the sense that you do not have to hire your own offensive security specialist or wait for a once-a-year audit. The swarm works on your infrastructure for the whole length of the subscription. It does not replace a human in the final judgement: a PWNONE pentester confirms or rejects every finding before the report. You gain a capability you do not have to build in house, with accountability for the result sitting on our side.
Can the agents go outside the agreed scope?
The scope is a single file treated as one source of truth, approved by you and by the pentester. It is enforced by code on every tool call rather than by the model's judgement, so an action outside the scope simply does not run. Widening the scope mid-test means editing that file and approving it again.
What about actions that could break something?
DA1MON separates safe actions from potentially destructive ones. The first group may run automatically. Anything that could affect system availability, trigger EDR or bring a service down waits for a decision. For the riskiest actions we use double approval: the PWNONE pentester first, then you.
Why do you not show a percentage of work completed?
Because it would be misleading. As it works, DA1MON discovers further assets and paths, so the scope of the analysis can grow. Instead of percentages we show concrete numbers: how many paths were identified, how many were verified and how many findings are waiting for confirmation.
How much does it cost?
The packages on this page are still a model rather than a fixed price list. The detailed scope and the number of available operations are agreed after we analyse your environment. Book a call and we will come back with a concrete proposal.
Can I simply buy access?
Not straight away. Before any testing starts we verify the company, the scope and the right to act on the infrastructure in question. This is not a service that can be bought without talking to the team, and we keep it that way on purpose.
Put DA1MON to work on your own infrastructure
We will show DA1MON live, go through your environment and match the scope of testing to what you actually run.
Before any testing starts we verify the company, the scope and the right to act on the infrastructure in question.