01 · todayshipping
What ships now
Point it at a target you're authorized to test. Recon, a ranked assessment with the evidence behind each finding, and probes that confirm or refute a specific set of weaknesses.
Evidence, not adjectives Most tools tell you what they found.
Most tools tell you what they found.
Xseth tells you what it proved.
500 alerts, 3 that matter. Xseth runs the recon, reasons over a live model of your attack surface, then sends a non-destructive probe at its own conclusions. Every finding comes back with a status a machine assigned, and the evidence behind it.
CONFIRMED means deterministically verified, not exploited
An attack-surface map of an example target: 27 assets across four layers (subdomains, services and endpoints), with 13 minor findings scattered over them. 3 routes thread through those findings. Two are set aside as medium and low. One is marked critical because it is the only one that reaches the crown jewel, running api, then :8080, then /checkout, then customer records. Separately, 3 of the findings have been confirmed by probes (version → known CVE, TLS configuration, exposed interface). One of them is on that route and two are elsewhere. Every other finding is unproven.
0120340500raw signals
17152327assets
1213findings
3routes
3confirmed ✓
- 1api
- 2:8080
- 3/checkout
- 4customer records
Individually minor. Chained, they reach customer records.
Confirmed ✓version → known CVETLS configurationexposed interface
It confirms a finding is reachable, not that it's exploitable.The chain it just drew is reasoning, not proof.It does the legwork. You decide what's real.
Verify, don't guess
Watch it kill a false positive.
Two findings, the same severity on paper. Xseth probes both: one comes back CONFIRMED, the other is REFUTED and stays on the record. A scanner would have reported both and left the sorting to you.
xseth agent · reasoning
target acme.ioobserve:6379Exposed Redis datastoreflagged high
orientbanner = Redis · no AUTH seen in the handshake
decidedon't assume, verify it answers unauthenticated
act$ nuclei -t redis/redis-unauth · non-destructive▌
outINFO returned · server responds with no password
confirmed · unauthenticated redis
observe:21Anonymous FTPflagged high
orientbanner mentions "anonymous" · a scanner cries high
decidedon't trust the banner, probe the login
act$ nuclei -t ftp/anonymous-login · non-destructive▌
out530 Login incorrect · anonymous access refused
refuted · kept on record
xseth1 confirmed · 1 refuted▌
A scanner would report both as high. Xseth proves one and disproves the other, and both stay on the record.
Illustrative transcript, built from real probe classes. CONFIRMED means a deterministic probe reached it. Nothing was exploited.
Rendered from a real assessment against a demo target
Every claim carries its evidence
Expand any finding to see which probes ran and exactly what they matched. Then overrule the agent with your own verdict. This is the actual assessment, not a slide.
09:15
Threat Assessment
acme.example.com · xseth_demo_8829F
3
Findings
1
High
1
Confirmed
Findings
1. Exposed datastore: Redis reachable on the internet
HIGHNOT PROBED
A datastore reachable from the public internet with no transport security. If it is unauthenticated, anyone who can reach it could read or modify data.
2. Exposed CI/build login surface (Jenkins)
MEDIUMCONFIRMED
A CI/CD login page exposed to the internet on a known-vulnerable build. An attacker could target the pipeline and the secrets it holds.
3. Deprecated TLS enabled on the main site
MEDIUMUNPROVEN
Outdated TLS protocols weaken transport security and commonly fail compliance checks (PCI DSS, SOC 2).
The honest ceiling
A finding has four honest states.
Most tools have two: found, or not found. Xseth keeps four apart: what a probe confirmed, what a probe disproved, what nothing has verified yet, and what sits outside the classes we can test at all.
CONFIRMED
A machine verified it.
A non-destructive probe reached the issue and matched real evidence. The weakness is genuinely there and reachable. No language model can assign this status, and it does not mean we broke in.
REFUTED
We probed it and it was not there.
The probe ran and disproved the premise behind the finding. It stays on the report rather than quietly disappearing, and when a refuted step sits inside an attack path the whole path prints broken and gets down-rated.
UNPROVEN
Found, but not confirmed.
The evidence that raised it is on the record, and nothing has verified it. Unproven does not mean safe. It means not established, and we will not dress it up as fact to make the report look decisive.
NOT PROBED
Outside the tested scope.
Thirteen probe classes cover a specific set of weaknesses. Anything outside them is surfaced with its evidence for you to judge, and is never presented as confirmed.
What you get today
Coverage between pentests, with the receipts.
Run it whenever the surface moves, after a deploy or before an audit, for the engineer you already have. Honest about what it proved and what it only found.
01
Recon that finds the real surface
Subdomains, open ports and live services first. Then a discovery pass crawls the app, mines archived URLs and reads its API spec to find the parameters behind the front page, which is where server-side weaknesses actually live.
02
Ranked, with the evidence attached
The assessment separates what it observed from what it inferred, and caps its own confidence on anything it only inferred from a banner or an open port. It comes back in ten to twenty minutes on a typical surface.
03
Probed, not assumed
Thirteen probe classes confirm or refute the findings that matter, and the refutations are kept on the record too. A machine assigns that verdict, never a language model.
04
Your verdict outranks the agent
Disagree with a finding and mark it a false positive. Your verdict supersedes the agent's and sticks across re-scans, and the agent's original row is kept for audit.
05
A report you can hand over
Export any assessment as a client-ready PDF: prioritized findings with evidence, impact, and remediation, in plain prose. Drop it in a ticket, or send it to the client.
06
Ask Thoth
Every assessment ships with Thoth, a grounded chatbot that answers questions about your findings, validations, and attack paths, and cites the data behind each answer. It's read-only: it explains the scan and never invents a finding.
Scanner vs. engine
A checklist can't refute itself
Xseth keeps a model of the target, reasons over it, and decides what to look at next. That is what makes a probe worth sending: it knows which claim is worth testing.
02 · the enginealready built
The cognitive core
A live world-model of the target, a reasoning pass that chains low findings into a real path, and a bounded decide-loop that picks the next thing to look at. This is what a checklist can't do.
world-modelattack-chainingOODA looporax
Orax, the validation layer, goes after logic flaws a template cannot reach: SSRF, IDOR and BOLA, BFLA, authentication bypass. Built and gated. It has not yet returned a verdict on a production target, so we name it without claiming it.
How the cognitive core works03 · the visionroadmap
Proof of impact
Chaining a confirmed weakness through to a demonstrated outcome, always scope-bound, approval-gated, and audited. The engine is built; the hands come one capability at a time.
See where it's goingConsent & scope
Nothing active fires without you.
Seven probe classes are quiet enough to run unattended. Six touch the application actively, and those are only ever proposed. An operator approves each one before it runs.
Scope
Scope is the spine.
SmartGate refuses off-limits targets (hospitals, governments, schools and critical infrastructure) before a single packet leaves. Every target the agent invents afterwards is re-checked against your authorized scope before anything runs.
Consent
Six classes wait for a human.
Active-payload probes are never dispatched automatically. The agent proposes them; an operator approves each one, and approval mints a single-use, scope-bound token that expires.
Audit
Everything is on the record.
Every decision the agent makes is logged, including the probes that refuted a finding. Your data stays recon metadata, never source code or secrets.
Who it's for
Built for the team of one.
Consultants are precise and expensive. Scanners are cheap and noisy. Xseth is the third option, for people covering an attack surface that used to take a team.
The CTO, or the first security hire.
A SaaS, fintech or healthtech company of 20 to 300 people, carrying SOC 2, ISO 27001, NIS2 or DORA obligations. Usually the trigger is an auditor or an enterprise customer asking for continuous evidence, and the honest answer today is an annual PDF.
Consultancies, MSSPs and MSPs.
Buying capacity instead of headcount. One contract carries three to twenty of your own clients underneath it, each in its own tenant, with white-label reporting.
// in good company
Programme memberships
Credit and community programmes, not investors. Listed here because they are verifiable, and stated as exactly what they are.
Frequently asked
Questions, answered
Straight answers to what teams ask before their first scan.
What does Xseth do, exactly?
Xseth maps your attack surface with the tools a human tester reaches for, ranks what it finds with the evidence attached, then sends a non-destructive probe at its own conclusions. Findings come back CONFIRMED, or honestly marked unproven, and the probes that refuted a finding are kept on the record too. You review it and decide what's real.
What does CONFIRMED actually mean on a finding?
It means a non-destructive probe reached the issue and matched real evidence, so the weakness is genuinely there and reachable rather than a guess. That is reachability, not exploitability: Xseth shows the weakness is really there, not that it can break in. Anything without that evidence stays marked unproven.
Will Xseth attack my production systems?
Seven of the thirteen probe classes are quiet enough to run unattended, and all thirteen are non-destructive. The six that touch the application actively, like default-credential or injection checks, never fire on their own: the agent proposes them, an operator approves each one, and approval mints a single-use token bound to that exact target and class.
How much of my attack surface will it find?
We don't publish a detection rate and we won't invent one. Xseth's coverage today is exposed infrastructure, service versions with known CVEs, TLS, misconfiguration and exposures, plus the parameterised web surface it discovers by crawling. It does not test business logic or authentication bypass, and it isn't a substitute for someone who does.
How long does an assessment take?
Usually ten to twenty minutes from submitting a target to a ranked threat assessment, depending on the size of the attack surface. A measured run against a 46-origin estate took about twelve.
Is my source code sent anywhere?
No. We only send recon metadata to our LLM provider: subdomains, ports, banners, and the HTTP and Nmap evidence used to build the assessment. Never your source code or secrets, and only for targets you're authorized to scan. Self-hosting is on the roadmap.
What am I allowed to scan?
Only targets you're authorized to test. SmartGate refuses off-limits categories (hospitals, governments, schools and critical infrastructure) before a single packet leaves the box.
Does Xseth replace a penetration test?
No. Xseth is a force multiplier, not a compliance pentest. It makes one engineer faster and cuts down false positives. It supplements human-driven and compliance-grade testing rather than replacing it.
Early access
Become a design partner.
We're onboarding a small group of technical teams to run real targets, self-evaluate the results, and shape what Xseth becomes. Early access, a direct line to the founders, and straight answers about what works today and what's still roadmap.
$349 to $1,200 a month, free during early access · see plans