Scanners find CVEs. We find breaches.
ShieldProbe runs a real attack campaign — not a scan — on your web apps and APIs. Business logic flaws, multi-step exploit chains, auth bypasses, API authz gaps. Audit-grade report in 48 hours. CREST-certified human validation on every finding. Unlimited retests for 12 months.
Competitors saw a JPEG. ShieldProbe saw an entry vector.
Same target, same scope, same clock. Here's what the reasoning difference produced.
- Scanned avatar.jpg — treated as a static asset, never parsed.
- Tested form endpoints — got HTTP 200, marked healthy.
- Ran WAF signature rules — no known CVE pattern matched.
- Business-logic layer — out of scope, no template to follow.
- Report delivered: 0 critical findings.
Signature-based testing can't reason. It matches known patterns or returns nothing.
- 1Analyzed the manager's profile avatar — the AI treated the image as an attack surface, not a decoration.
- 2OCR'd a blurry sticky note visible in the background of the photo.
- 3Extracted credentials from the sticky note and tested them against the auth endpoint.
- 4Authenticated into the internal finance dashboard.
- 5Exploited a business-logic flaw to authorize a $50,000 fraudulent transfer.
Reproducible. Every step shipped with requests, responses, screenshots, and payloads. CREST-certified consultant signed the report.
What Assess actually finds
Scanners match known CVEs against known software versions. Your app's logic is custom — which is exactly where real breaches happen. These are the classes Assess is built to catch.
Business-logic flaws
A banking withdraw form that treats a negative number as a deposit. A discount coupon that stacks on itself. An API that trusts client-sent prices. Scanners return HTTP 200 and call it healthy.
Multi-step exploit chains
A low-severity path disclosure, a weak session token, and an exposed admin endpoint chained into full takeover. Each looks benign alone. The AI plans across them.
Auth & session flaws
JWT alg confusion, broken MFA paths, session fixation, cookie flag gaps, OAuth redirect misconfigurations. The kind of thing pattern-matchers can't test because the test requires reasoning about state.
API authorization bypass
IDOR, BOLA (broken object-level authorization), mass assignment, rate-limit evasion, GraphQL batching abuse, SOAP/REST/GraphQL coverage. The AI drives the API like an authenticated user who shouldn't have access.
Cross-layer chains
A low-severity cloud misconfiguration becomes critical when it enables lateral movement into an app with business-logic flaws. Single-layer competitors miss these paths by construction.
What CVE scanners systematically miss
Anything that isn't a known vulnerable dependency on a known version. Your custom logic, your auth flows, your billing rules, your admin pathways. All invisible to signature-based tooling. All in scope for Assess.
How the engagement actually runs
No abstract four-box diagram. Here's the mechanics a security engineer would ask about.
Blackbox or greybox
OWASP Top 10 or full WSTG
Internal testing via a 5 MB connector
Reproducible exploit evidence
CREST-certified human validation
12+ compliance output formats
What the 48 hours actually looks like
If speed is the only thing you've heard, you've heard the consequence, not the cause.
Scope & launch
You define targets in the platform. Methodology pre-selected. No back-and-forth on SoW for a week. Testing kicks off in hours, not weeks.
Live attack campaign
The reasoning engine runs a persistent agent — tracking targets, credentials, footholds, and hypotheses across the engagement. It chains exploits, pivots when it hits a dead end, and uses its kernel-level driver to drive real tooling (Burp, SQLMap, Metasploit) the way an operator would.
CREST-certified human validation
A certified consultant reviews each flagged finding against the replay evidence, removes noise, and signs off. This is where audit-grade comes from.
Report generation
Audit-grade report compiled into your chosen compliance format. Findings export to JSON/SARIF for your SIEM or ticketing. Defend can auto-apply virtual patches the moment findings land; Fix pushes candidate PRs into the developers' IDEs.
What Assess does not cover
Scope honesty is credibility. Here's what we decline.
Phishing & social engineering
Human-layer testing belongs with specialist consultancies.
Desktop applications
Thick-client native apps are not what we're built for.
Mobile applications
iOS and Android binary testing is out of scope.
Physical security
Badge cloning, lock-picking, facility access — not our surface.
Unlimited retests for 12 months — here's why we can give them away
Each retest is an atomic deterministic replay of the original exploit chain against your latest deploy. Not a fresh scan. Marginal cost to us is effectively zero, so it's free to you.
Traditional consultancies charge per retest because each run requires rebooking a human pentester. AI-only scanners charge because their runs aren't deterministic — every rerun re-discovers the same noise. Ours is a signed, replayable artifact.
Traditional consultancy, AI-only scanner, or Assess
Three paths to a pentest report. Here's where each one breaks.
| Traditional consultancy | AI-only scanner | ShieldProbe Assess | |
|---|---|---|---|
| Time to audit-grade report | 6–8 weeks | Hours, but not audit-grade | 48 hours, audit-grade |
| Business-logic depth | Varies by operator | None — pattern matching only | Reasoning engine, kernel-driven tooling |
| Human validation | Yes, by assigned consultant | None or self-attested | CREST-certified sign-off on every report |
| Retest model | Extra cost, scheduling | Re-run noise on every trigger | Unlimited, deterministic replays, 12 months |
| Evidence format | Narrative + screenshots | Signatures, often no exploit | Replayable payloads, requests, responses |
| Auditor acceptance | Usually yes | Frequently rejected | Big 4 auditors accept directly |
| Price band | $50–200K per engagement | Cheap, low signal | $10–120K/year, 40–60% below consulting |