badai.red Nightwatch: all systems watched
Product · Offense

Rogue. The attacker you hired.

Rogue is an autonomous penetration testing platform: hundreds of coordinated AI agents that find, exploit and chain weaknesses across your whole attack surface — then prove it, fix-ready, before anyone else gets the chance.

Scope a Rogue engagement →Pricing
Five attack modules

One adversary. Every surface.

Each module is a team of specialist agents. They share findings in real time, so a leaked key from the web module becomes a cloud escalation path in seconds — exactly how a real intrusion unfolds.

ROGUE/EXTERNAL

Your perimeter, as the internet sees it

Continuous discovery of domains, forgotten hosts, exposed admin panels, VPN and edge appliances. Rogue fingerprints, exploits the ones that matter, and tells you which three to patch tonight.

ROGUE/WEB

Apps & APIs

Authenticated testing for IDOR, broken auth, SSRF, injection and business-logic flaws across REST, GraphQL and gRPC.

ROGUE/INSIDE

Assumed breach

Starts from one compromised laptop. Active Directory paths, credential reuse, lateral movement to domain admin.

ROGUE/CLOUD

Cloud identity

IAM privilege escalation, cross-account trust abuse and Kubernetes breakouts across AWS, Azure and GCP.

ROGUE/AI

LLM apps & agents

Prompt injection, indirect injection through documents and email, tool abuse, system prompt and data exfiltration. Learn more.

How an engagement runs

From signature to first critical in an afternoon.

Rogue is delivered as SaaS with an optional self-hosted runner for internal and air-gapped networks. No agents to install on endpoints.

  1. Sign the rules of engagement

    Scope, exclusions, testing windows and stop conditions in one machine-readable file — enforced by the network layer, not trust.

  2. Plant canaries

    We seed fake records in the systems you care about. Reaching one is proof of impact. Real data stays untouched.

  3. Agents attack

    Recon, exploitation and chaining run in parallel. Watch it live in the console or wait for the summary.

  4. Findings with proof

    Each issue arrives with the chain, the evidence, a replay script and the smallest fix. Tickets route to the owning team.

  5. Retest on merge

    When a fix ships, Rogue replays the chain. Ticket closes only when the attack fails.

Benchmarks

Scored against humans. Then against itself.

We publish how Rogue performs on public offensive-security benchmarks and on our own 1,200-challenge internal suite of realistic, chained targets. Methodology is available under NDA.

91%of web-exploitation benchmark challenges solved, versus a 34% median for experienced human testers in the same time box
28 minmedian time to complete a five-step chained exploit on our internal suite
0out-of-scope requests in the last 2.1 million agent actions, enforced at the network layer
1stplace across our internal suite against every autonomous pentesting tool we could license
Sample output

A finding your engineers will actually fix.

This is the shape of every critical Rogue files. No CVSS soup, no 200-page PDF: a chain, a proof, a fix and an owner. The report for auditors is generated from the same data.

Continuous vs annual pentesting →

SEC-8812 · rogue/web · retest: scheduledCritical · 9.4

OAuth authorization code theft via legacy SSO open redirect

Asset
sso-legacy.example-corp.com → billing.example-corp.com
Impact
Account takeover of any billing user who clicks a link; read access to 41,207 invoices proven via planted canary record.
Detected?
No. No alert in SIEM or EDR. Nightwatch rule BW-3192 drafted.
Fix
Exact-match redirect_uri allowlist on IdP client 0x41; rotate client secret.
  1. 1Open redirect on /sso/continue accepts any https hostT+07m
  2. 2IdP allows wildcard redirect for legacy clientT+12m
  3. 3Code exchanged for session as svc-billingT+18m
  4. 4Canary invoice INV-CANARY-77 retrieved, chain haltedT+22m
$ rogue replay SEC-8812 --dry-run ✓ step 1 302 → https://callback.rogue-lab.net/c ✓ step 2 code=7f3c…a1 captured (redacted) ✓ step 3 session issued: role=billing_reader ✓ step 4 canary match · sha256 9e1b…04 replay deterministic · safe to run in CI
Integrations

Plugs into how you already work.

Rogue ships findings where your teams live and pulls context from the tools you already pay for.

CategoryWorks with
TicketingJira, Linear, ServiceNow, GitHub Issues, GitLab
CloudAWS, Microsoft Azure, Google Cloud, Kubernetes, Cloudflare
IdentityOkta, Microsoft Entra ID, Google Workspace, Active Directory
CI/CDGitHub Actions, GitLab CI, Buildkite, CircleCI, Jenkins
DetectionSplunk, Microsoft Sentinel, Google SecOps, Elastic, CrowdStrike, SentinelOne — via Nightwatch
MessagingSlack, Microsoft Teams, PagerDuty, Opsgenie
FAQ

Rogue, answered.

For safety controls in depth, read our rules of engagement.

What does Rogue test?

External perimeter, web applications and APIs (authenticated and unauthenticated), internal networks and Active Directory in assumed-breach mode, cloud identity and configuration across AWS, Azure and GCP, Kubernetes, and LLM-powered applications and agents.

Does Rogue replace human penetration testers?

It replaces the repetitive 80% — recon, enumeration, known exploit classes, chaining and retesting — and does it continuously. Our human Red Cell operators take on objective-based adversary emulation, physical and social engineering, and the strangest business-logic targets. Most customers use both.

How does Rogue prove impact without touching real data?

Before an engagement we plant canary records — fake invoices, users or files — inside the systems in scope. Rogue proves access by retrieving the canary and halting. Real records are never exfiltrated, and any incidental data seen in responses is redacted before it is stored.

Can Rogue run in CI/CD?

Yes. Rogue/Web can test every preview environment and block a merge when a proven critical is introduced. Every finding ships with a deterministic replay script you can run in your own pipeline as a regression test.

Will it satisfy our compliance pentest requirement?

Rogue reports map findings to PCI DSS 11.4, SOC 2 CC7, ISO 27001 A.8.8, HIPAA and DORA testing requirements, and Red Cell operators sign off the annual attestation where an auditor requires a named human tester.

Point Rogue at one system.

Pick the application or perimeter you worry about most. We'll scope a ten-day Rogue Sprint and show you the first proven findings in the first week.

Book a briefing →See pricing