The words we use, and the lines we don't cross.

Glossary

CORTEX

The cognitive core of Xseth: the parts that reason rather than just scan. It runs the Observe, Orient, Decide, Act cycle over a shared model of your attack surface.

OODA loop

Observe (scan) → Orient (rank and chain findings) → Decide (continue or stop?) → Act (validate). A bounded decision loop with a hard step budget and a full audit trail, so it always terminates.

World-model

A persistent graph of your hosts, subdomains, services, web endpoints and the edges between them. The agent reasons over this structure instead of raw output, and it grows as you re-scan.

Attack chain

A multi-step path where individually-low findings combine into a high-severity outcome: "exposed config + weak service → real access". Candidate reasoning, not proof; an empty result is valid.

CONFIRMED

A finding a non-destructive probe reached and matched real evidence against. It means the issue is genuinely there and reachable: reachability, not exploitability. This status is assigned by a deterministic probe, never by a language model.

REFUTED

A probe actively disproved the premise behind a finding, rather than simply failing to confirm it. The result is kept on the record, and when a refuted step sits inside an attack chain the whole chain prints broken and is down-rated. A finding nobody probed and a finding we disproved are different things, and Xseth keeps them different.

UNPROVEN

A finding that was raised but has not been confirmed. It stays on the report with the evidence behind it, shown honestly as unproven rather than asserted as fact. Unproven does not mean safe; it means not established.

NOT PROBED

A finding outside the tested scope, because no probe class covers it. It is surfaced with its evidence for you to judge and is never presented as confirmed. See the probe-class roster below for exactly what is and is not covered.

Evidence discipline

The rules the assessment pass writes under: exposure it observed and misconfiguration it inferred stay separate, anything inferred from a banner or open port alone is capped at low confidence, and no finding title may assert a condition no probe has checked. Most false positives are a language problem, so the language is constrained.

Adjudication

Your verdict on a finding: true positive, false positive, or needs review. It supersedes the agent and drops the finding out of the exported report. The agent’s original row is kept for audit, so the disagreement stays on the record.

Thoth

Xseth’s grounded chatbot (named for the keeper of knowledge) that sits on every assessment. It answers questions about that scan’s findings, validations, attack paths and decisions, citing the pipeline data behind each answer. It is read-only: it explains the scan, it never launches one or invents a finding.

Non-destructive probe

A validation check that confirms or refutes a finding without exploiting it: no code execution, no data exfiltration. All thirteen probe classes are non-destructive; seven of them are quiet enough to run unattended.

Active-payload probe

One of the six classes that touch the application actively: default credentials, XSS, SQL injection, open mail relay, open redirect and CORS. Still non-destructive, but intrusive enough to need consent: they never run on their own, and each one requires explicit operator approval plus a one-time, scope-bound token that expires.

Scope

The set of domains and IPs you are authorized to scan. Every action is re-validated against your scope before it runs; reserved and internal addresses are hard-blocked outright.

Force multiplier

How we position Xseth: a tool that makes one security engineer faster and sharper, not a replacement for a human tester or a compliance-grade pentest.

The thirteen probe classes

A probe class is a specific weakness a deterministic check can confirm or refute. There are thirteen, and all thirteen are non-destructive. Seven run unattended. Six touch the application actively enough to need your consent, so they are only ever proposed: an operator approves each one, and approval mints a single-use, scope-bound token that expires.

This list is the boundary of CONFIRMED. A finding outside it is reported as NOT PROBED, with the evidence that raised it, and is never presented as verified.

Seven automatic classes, run unattended

version-cve

A detected product version matched against known CVEs.

exposure

Files, panels and interfaces exposed to the internet that should not be.

misconfig

Server and application misconfiguration on a live web service.

takeover

A subdomain pointing at a service that could be claimed by someone else.

tls

Deprecated protocols, weak ciphers and certificate problems.

ftp-anon

Whether an FTP service genuinely accepts anonymous login.

dns-open-resolver

Whether a DNS service really answers recursive queries for anyone.

Six gated classes, proposed and never auto-dispatched

default-login

Known default credential pairs. Submitting them risks account lockout.

xss

Cross-site scripting, using active payloads against the application.

sqli

SQL injection, using active payloads against the application.

smtp-open-relay

A real relay handshake, stopped before any mail could be delivered.

open-redirect

Whether a redirect parameter will send a visitor off-site.

cors

Whether a cross-origin policy actually trusts an attacker-controlled origin.

What Xseth does not do

A skeptic's most useful question is "what can't it do?". Here is the straight answer. These are not limitations we hide; they are the boundary we designed in. Anything beyond it that we are building toward stays scope-bound, approval-gated, and audited.

• Exploit vulnerabilities or break into systems
• Reuse captured credentials or escalate privilege
• Move laterally across a network
• Run active-payload probes without operator approval
• Scan anything outside your authorized scope
• Touch your source code or secrets: only recon metadata is processed
• Replace a manual penetration test or a compliance engagement