CNRT Vanguard
An autonomous pentester. Vanguard plans and runs a full kill chain against your authorized targets, from reconnaissance to domain dominance, with an agent that reasons, acts and reports. It has root inside its own throwaway box, and the scope you sign decides what it can reach.
Credential reuse from a service account gave a foothold on the gateway. Reproduction steps and evidence captured.
Escalation attempted from the foothold. Host policy held, so the path stops here.
Manual penetration tests are slow, costly and infrequent, so the path an intruder would take goes untested between them.
Vanguard runs the full attack chain autonomously against the systems you authorize and shows you every step it took.
A kill chain, not a bag of scripts
Every technique is mapped to the MITRE ATT&CK matrix, and playbooks chain them into milestones, from the first packet to domain admin. 66 techniques are built and live across 50 ATT&CK technique IDs and 70 playbook milestones, so a run follows the path a real intruder would take rather than firing unrelated checks.
Reason, act, observe, and you watch every step
A planner breaks the objective into milestones. A worker agent drives real tools inside the range, reads the output and decides the next move. Every thought, command and result streams to a live console as it happens, and the trace is written to disk as it runs, so a stopped step still leaves a readable report.
Root inside its own box, held to the scope you sign
Every run's attacker lives in its own disposable machine that the agent controls completely. What it can reach is decided beneath it: egress starts closed, and the agent earns each in-scope address as you authorize it. Anything off-scope is refused and logged, whether the agent behaves or not.
Technical specifications.
Built at Quantum Ventura and sold on its own. It runs only against targets the customer has authorized in writing, and access is restricted to provisioned accounts.
| Category | Autonomous penetration testing |
|---|---|
| Coverage | 66 techniques mapped to MITRE ATT&CK, six kill-chain stages |
| Boundary | Fail-closed egress, enforced outside the agent |
| Isolation | A throwaway attacker, bridge and firewall per engagement |
| Models | Works with the LLM provider you choose, switchable per run |
| Deployment | Single node |
| Interface | Multilingual, English and Japanese in place today |
Tell us what you're working on.
Our team replies within two working days, wherever you are.