Essays, benchmarks, and half-formed opinions from the 4rthur team. Written for people who buy, sell, or live inside offensive security, and occasionally for the curious.
The exploits behind the numbers: split-claim cap bypasses, nested-injection admin takeover, full PHI exposure and a chained VaultBank admin compromise.
G4LAHAD against Strix OSS, Shannon OSS and Claude Code on three real multi-role web apps: 122 verified medium+ findings, and 42 no other candidate found.
An asset list is a list of things you already know you own. The Adversarial Assessment starts from your company name instead — no scope, no kickoff, free for a limited time.
Software ships hourly and attackers never stop, yet most companies still test once or twice a year. The annual pentest is dead; AI makes monthly the norm.
Man-day billing pays the same whether a vendor finds serious problems or none. Full refund on a clean result, and every test case disclosed.
Man-day pricing rewards time spent, not outcomes achieved. The first post in our founding story series.
Going broad or deep remains a strategic, rather than scientific, decision that separates different autonomous pentest products.