Red Flag – Ethical hacker
Proprietary AI analysis
Red Flag – Ethical hacker is our in-house analysis platform for AI-driven risk identification. Specialised agents map the target, surface deviations and test them — automatically and continuously — while every finding is verified by a consultant before it reaches a report. What a manual review samples at human speed, the platform analyses in full within minutes.
Our Red Flag – Ethical hacker tool consists of various agents specialised to accomplish tasks, but that can be used in concert to achieve otherwise difficult objectives.
Our tests against live, important infrastructure — mainly in Switzerland — have shown a success rate above 90 per cent, with penetration achieved for large companies (100 sites or more) within minutes.
We are constantly testing, and we sometimes add new capacity agents that we believe will fit.
The agents
Pen X agent
A hacking agent that can be used to test or penetrate from the outside, with normal access.
Method
Uses every available tool to try to gain access, elevate privileges or find holes in the defences. Tests for zero day vulnerabilities and known CVEs.
Infrastructure assessment agent
Maps and documents the environment.
Method
Maps the infrastructure using an admin account and verifies that the map is complete.
Tests according to the Infrastructure assessment documentation.
Provides a report showing the mapped structures. It can contain recommendations for restructuring, but the main purpose is to provide input to the Pen I agent.
Pen I agent
Internal penetration testing — inside the network, with admin access.
Method
Reads the infrastructure report and tests for vulnerabilities.
Draws up a plan for mitigating the risks found.
Assesses the workload required to address the vulnerabilities — for example isolating networks and servers and hardening specific weak points.
Our infrastructure analysis tests what would happen if someone penetrated the outer layers. This involves manual work and produces one or more reports that the IT department can use as recommendations for different security levels, in order of priority.
Triage agent
A verification agent that is started by the penetration agents once a written report exists.
Method
Reads the report and tests through all the POCs, and preserves the evidence.
Communicates with the penetration agent so that the report only contains real, verified findings that have a security impact.
Manual revision
AI has come a long way, but it can still make things up — no matter how well the prompts are written. It is also limited in areas such as imagination, and lacks what we call intuition.
Because of these limitations we always carry out a manual assessment of every finding and make sure the POCs are fully functional. At least one consultant also follows the AI through the initial assessment.