Private build · External VA shipped
StrikeFirst.AI is the attack console for cyber operators. Deterministic playbooks discover and test the attack surface inside the scope you set. A human approves every step that touches a target, and every action lands in an append-only audit trail: rails built for agentic AI.
For authorized security assessments only.
Platform
Operators need speed without surprises. StrikeFirst.AI makes every run repeatable, reviewable and provable, from the first DNS lookup to the final report.
Engagements run as DAG playbooks of capabilities, not ad-hoc scripts. Discovery is recursive, so every new in-scope host is enumerated, resolved, scanned and assessed. It's also bounded, so the same seed produces the same run, every time.
Target-touching steps stop at approval gates. Operators see the exact resolved targets before anything runs and can edit the inputs. Every decision is recorded with the approver and their notes.
Post-run AI analysis turns raw tool output into explained, prioritized findings and report-ready narrative. PHIL, our pseudo-human in the loop, brings agentic automation to the playbook's decision points. Every decision, human or PHIL, goes through the same scope enforcement and audit trail.
How it works
One playbook, five stages, and a human decision at the moment it matters.
Domains, CIDRs and exclusions, tied to the engagement's authorization.
Passive OSINT and DNS discovery map the surface recursively.
The run pauses. An operator confirms the resolved targets.
Awaiting approvalPort, vulnerability and web scanners test only what's in scope.
PDF and XLSX deliverables, plus a timeline for the client's SOC.
Product
Real screenshots of the current build, running a fictional engagement against documentation-only domains and addresses.
Trust
The guardrails aren't a policy document. They're how the platform runs.
Every discovered asset is classified in scope, needs review or out of scope. Only in-scope assets feed active steps; the rest are recorded and never touched.
Pre, post, error and approval entries for every action, correlated per run. The audit trail outlives the data it describes.
A client-to-project hierarchy with role-based access for admins, leads, operators, viewers and auditors.
A one-click PDF deliverable with findings by risk, and a multi-sheet XLSX workbook covering findings, assets, the audit trail and the toolchain.
Hand the client's SOC an activity timeline of every tool execution, with source addresses and targets, ready to load into the client's SIEM.
Every tool sits behind one capability interface, so new integrations slot in, and existing ones can be swapped, without rewriting playbooks. Each run records exactly which tool and version did the work.
Progress
Where StrikeFirst.AI stands today.
Early access
We're onboarding a small group of security teams ahead of the hosted launch: penetration-testing firms, MSSPs and internal red teams.
StrikeFirst.AI is for authorized security testing only.