Bad AI, on a leash.
An offensive AI is only useful if you can trust exactly where it goes and what it does. These are the controls that hold on every engagement, for every customer.
Controls
Signed scope, enforced in the network
Rules of engagement compile to egress policy. Out-of-scope traffic is dropped before it leaves our infrastructure — prompts are not a security boundary.
Canary proof, not real data
Impact is demonstrated by retrieving planted canary records. Incidental sensitive data is redacted before storage.
No destructive payloads
No denial-of-service, no ransomware simulation on production, no data modification unless explicitly scoped for a test environment.
Human gates for risk
Techniques above a risk threshold — and Nightwatch tier-2 actions — require approval from a named person on your side.
Every action logged
A tamper-evident log of every request, tool call and model decision, exportable to your SIEM in real time.
Two-second kill switch
One button — in the console, Slack or via API — halts every agent on your engagement globally.
Tenant isolation
Per-customer encryption keys, isolated runners and no training of shared models on customer data.
Customer vetting
Know-your-customer checks before any offensive capability is enabled. We decline engagements we can't verify.
Safety, answered.
Security questionnaires, our MSA and DPA are available on request.
Can Rogue attack something outside our scope?
No. Scope is compiled into network egress policy for the agents: requests to any host, IP range or cloud account not in the signed rules-of-engagement file are dropped before they leave our infrastructure, and the attempt is logged.
What happens if Rogue causes an outage?
Rogue avoids denial-of-service, destructive payloads and high-volume brute force by default. Rate limits are set per asset, and production-sensitive assets can be restricted to read-only techniques or specific windows. A kill switch stops every agent globally in under two seconds.
Do you train your models on our data?
No. Customer engagement data and Nightwatch telemetry are never used to train shared models. Tenant data is encrypted at rest with per-customer keys and deleted on request or at contract end.
Who can buy BadAI?
Only verified organisations testing systems they own or are authorized to test. We perform know-your-customer checks before any offensive capability is enabled.
Ask us the hard questions.
Bring your risk team to the briefing. We'll walk through the controls on a live engagement.