confirmedA-4471
Time-based SQL injection
- request
- GET /api/orders?id=
- payload
- 1'||sleep(5)--
- oracle
- Timing delta 5.02s, reproduced on a clean session.
- score
- 9.1 · CWE-89
Replayed three times from a fresh login. The delay held every time.
RedAssay
An AI pentest agent that
proves what it finds.
97.5% precision1.3% false positivesOWASP Benchmark v1.2
It drives a real browser through your app like a user, then replays every candidate before reporting it. What the replay cannot reproduce never reaches you.
- No third party sees your data
- Dedicated infra for enterprise
- Nothing ships unproven
Why triage eats the week
A scanner without proof
is wrong four times in five.
OWASP puts the false-positive rate of a typical DAST tool at around 82%. Every one of those still costs an engineer the time to open it, read it, and decide.
How it runs
One authenticated session,
four stages, no agent on your side.
You give us a target and a rules-of-engagement document. Everything below happens on our infrastructure.
- 01
Drive
A real Chromium session works the app the way a person does: form login, Google or a saved session, then clicking, submitting and paginating.
- 02
Capture
Every backend call it provokes is caught: XHR, GraphQL, WebSocket frames, form posts. The stack is fingerprinted from the same traffic and mapped to OSV and NVD.
- 03
Probe
A differential engine and 44 checks exercise the captured surface. Blind bugs are proven out of band through an HTTP or DNS callback, inside a scope allowlist and a request budget.
- 04
Replay
Each candidate is re-issued from a clean session. The oracle has to fire twice on identical evidence before anything is scored.
Captured surfacesynthetic
- GET/api/session200
- POST/api/auth/login302
- GET/api/orders?id=41200
- POST/graphql {orders(first:50)}200
- GET/api/users/me200
- GET/assets/app.<hash>.js.map200candidate
- WS/socket order.updated101
- POST/api/orders201
- GET/api/orders?id=41%27500candidate
- GET/api/orders?id=1%27||sleep(5)--200A-4471
candidates raised 3confirmed pending replay
Go control plane, Playwright browser sidecar, open-weight models we host ourselves. No prompt and no captured request leaves that boundary.
What you get back
A report two audiences can read
Engineers get the request, the payload and the replay. Your auditor gets the finding, the score and the proof.
Machine output for CI
JSON, SARIF 2.1.0, PDF, and an exit code your pipeline can fail on.
A run you can re-derive
Every prompt, tool call and request is logged. Ask for any finding and we replay it in front of you.
Synthetic run
One session turns 1,284 requests
into 12 endpoints worth attacking.
The gate
Pick a candidate and see
what actually proved it.
All three came out of the synthetic run above. Two survive replay. The third does not, so you never see it.
focus /api/orders?id= · 3 proofs · 2 preconditions
Choose a candidate. Arrow keys move between them.
Benchmarks
Measured on public testbeds.
Published with the gaps.
Public benchmarks, served locally, scored against the same detectors that ship. Every figure states the sample it came from, and anything we could not measure is listed as not measured.
Assay sheetbenchmark v0.1.0 · rev 5 · 2026-09-11
97.5%
Precision
OWASP Benchmark v1.2
1.3%
False positives
OWASP cites ~82% for typical DAST
46.4%
Recall
black-box-observable slice, 163 cases
OWASP Benchmark v1.2
Detection accuracy across 2,740 labelled cases, real vulnerabilities against planted false positives
97.5% precision · 1.3% FP · 46.4% recall
sample of 163 form-parameter cases across 6 categories
measured
WAVSEP
A second accuracy testbed, with a false-positive set built to fool scanners
66.7% recall · gate cuts FP 37.5% to 12.5%
the gate held 2 of 3 raw false positives at needs-review
measured
VAmPI
REST API security, with a vulnerable/secure toggle on the same endpoints
3 of 7 documented vulns · 0 confirmed false positives
including a JWT weak key cracked, re-signed and replayed, which is a proven auth bypass
measured
OWASP Juice Shop
The full pipeline end to end: browser, checks, agent, gate
18 findings · 14 confirmed, 4 held as candidates
the agent claimed an SQLi; the gate held it at needs-review until replay
measured
CVE-Bench
Class coverage across a 40-CVE exploitation dataset
36 of 40 fall in a class we have a detector for
a coverage ceiling rather than an exploitation score, since the targets were not run
projection
Meta CyberSecEval
Prompt-injection resistance of the open-weight model we run the agent on
88% resistance · 12% attack-success rate
25-case sample, deterministic substring judge, seed 11
measured
AutoPenBench
Agentic exploitation, graded by an LLM judge
Not run, so not claimed
its agent and its grader both need a capable model, and a 9B grading itself is not a score
not run
Every figure is keyed to the benchmark version that produced it and re-derivable from the recorded command. Bring the sheet to the call and we will walk any number on it.
Not claimed
The same run measured what we cannot do yet. These are open, and they are the next thing we close.
- 01Header and cookie injection vectors, roughly a third of the OWASP Benchmark, are outside the fuzzer’s reach today.
- 02Blind path traversal and XPath injection produce no black-box signal our oracles can read. There is no detection path yet, and we will not guess.
- 03API access control and auth logic need multi-identity, stateful context the black-box checks do not carry. Across WAVSEP and VAmPI this is the clearest coverage gap.
- 04The figures are sampled rather than exhaustive: 163 cases of 2,740, to bound wall-clock.
What it is
01
Continuous
It runs on every deploy instead of once a year, so exposure is measured in hours rather than months.
Triggered by CI, webhook, or schedule
02
Proven
A candidate becomes a finding only when a deterministic replay reproduces it. There is no probability score to interpret.
44 replay-confirmed checks · ~90 orchestrated tools
03
Contained
We run the assessment on infrastructure we control, on open-weight models we host ourselves, and on dedicated infrastructure for enterprise customers who need it. Your traffic, your code and your findings never reach a third-party service.
Dedicated infra on request · run data deleted on request