What Xseth is, and what it isn't.
Xseth maps your attack surface with the same tools a human tester reaches for, ranks what it finds into a prioritized threat assessment with the evidence behind each one, and then sends a non-destructive probe at its own conclusions so the ones that matter come back confirmed or honestly unproven. It writes the result up as a report you can hand to a client, usually in ten to twenty minutes. It doesn't break in, and you stay in control of every decision.
Three layers, never blurred
A skeptical reader deserves to know exactly where the line is. We keep three claims separate and label every feature against them, so you always know what's shipping versus what we're building toward.
An engine that probes its own findings
Xseth runs the real tools, ranks what it finds with the evidence attached, then sends a non-destructive probe at the findings that matter so each one lands confirmed or honestly unproven. Refutations are kept on the record too. It exports a client-ready report, and you can interrogate every result through Thoth, its grounded chatbot. A human stays in the loop throughout.
A cognitive core
A persistent world-model of your attack surface, a reasoning pass that chains low findings into real paths, and a bounded decide-loop. This is what makes a probe worth sending: the engine knows which claim is worth testing.
Orax, the validation layer
A deeper class of prover aimed at logic flaws a template cannot reach: SSRF, IDOR and BOLA, BFLA, and authentication bypass. It is integrated and operator-gated, and it has not yet returned a verdict on a production target, so nothing on this site is badged CONFIRMED by it. We name it because it is real and because you will see it in the console, not because it has earned a claim yet.
Proof of impact
Progressively more autonomous testing, always scope-bound, approval-gated, and audited. We fence this as future and never sell it as today.
Read next
How it works
The six acts of an assessment, the cognitive core that reasons over your attack surface, and the rules that keep the model from claiming what it never checked.
03Using Xseth effectively
A practical walkthrough: authorize a target, run a scan, read the assessment and the badges, ask Thoth, and export the report.
04Concepts & limits
A plain-language glossary of every term Xseth uses, plus an explicit, unflinching list of what it deliberately does not do.
Straight answers
Is Xseth an autonomous hacker that breaks into my systems?
No. Today Xseth maps your attack surface, ranks the findings with evidence, and non-destructively probes a class of them to confirm or refute each one, with a human in the loop. It doesn't exploit, reuse credentials, escalate privilege, or move laterally. Those remain on the roadmap, and any future step there stays scope-bound, approval-gated, and audited.
What happens to a finding a probe disproves?
It is kept, not quietly deleted. The refutation stays on the record with the output that produced it, and when a refuted step sits inside an attack chain the whole chain prints broken and is down-rated. A finding nobody probed and a finding we disproved are different things, and Xseth keeps them different so you can see what was actually checked.
What is Thoth?
Thoth is the grounded chatbot that ships with every assessment. Ask which findings are confirmed, or walk through the highest-impact path, and it answers from that scan's own data and cites it. It is strictly read-only: it explains a scan, it never launches one and it never invents a finding.
What does "CONFIRMED" actually mean on a finding?
It means a non-destructive validation probe reached the issue and matched real evidence, so the finding is genuine and reachable rather than a guess. The status is assigned by a deterministic probe, never by a language model. A probe that disproves a finding badges it REFUTED and that stays on the record; anything nothing has verified is shown honestly as UNPROVEN.
What can Xseth see, and is my source code or data sent anywhere?
We only send recon metadata to our LLM provider to produce the assessment: subdomains, ports, banners, and HTTP and Nmap evidence. Never your source code or secrets, and only for targets you're authorized to scan.
How do I stay in control of what gets scanned?
Authorization is the spine. You can only submit targets on your authorized scope, SmartGate refuses off-limits categories outright, and every target the agent derives afterwards is re-checked against your scope before anything runs. Active-payload probes never fire on their own. They wait for an operator to approve them.
Does this replace a penetration test?
No. Xseth is a force multiplier for a security engineer: faster coverage, ranked findings, less noise. It supplements human-driven and compliance-grade testing between engagements; it doesn't replace them.