Conventional security engagement begins the same way.

A vendor asks what you want tested. You send back a list of domains, IPs, applications, and user roles. That list becomes the scope, the scope becomes the quote, and the quote becomes the test.

Nobody attacking you does this.

An attacker's intake is your company's Internet footprints. From there they work outward to DNS, certificate transparency, job postings, code repositories, mobile app bundles, the subdomain from a campaign that ended in 2023. They aren't limited to what you remember owning.

The scope becomes the blind spot

The asset list you hand to a vendor is, by definition, a list of things you know exist and believe are worth testing. It is already filtered twice before anyone sends a single packet.

So a scoped pentest is very good at answering one question: Are the systems I already worry about secure?

It is structurally incapable of answering the more important one: What am I exposing that I have forgotten about?

We have seen the second question answered the hard way, repeatedly. It is rarely the flagship application. It is the test web application someone spun up for a quick demo and never took down. The subsidiary rebranded two years ago whose DNS still points at a server nobody has patched since. The vendor-hosted portal that carries your brand but not your controls. The marketing microsite with a CMS three major versions behind.

None of those appear on an asset list, because nobody in the room knows to put them there. The organisation cannot scope what it does not know it owns.

Procurement runs at the speed of paperwork

The second problem is time.

Between "we should get this tested" and "someone is actually testing" sits a chain of steps: a shortlist, an RFQ, a scoping call, a quote, revisions to the quote, legal review, a PO, a kickoff. In our years on internal security teams, that chain routinely took longer than the assessment itself.

Meanwhile the exposure has been sitting there the entire time, reachable by anyone who knows how to use a search engine. Attackers do not have a procurement cycle. The gap between their start time and yours is measured in weeks, and it is entirely self-inflicted.

We wanted to know what would happen if you delete that chain completely.

Our concept: Adversarial Assessment

We take your company name and brand. That is the entire intake.

From there, L4NCELOT handles discovery — OSINT, footprinting, and mapping the external estate as an attacker would build it, from the outside with no privileged information. G4LAHAD then probes what we found: the endpoints, applications, and services that surfaced during discovery rather than the ones you nominated.

You get a report on what is reachable today. No scope document, no asset inventory, no kickoff.

This is not a smaller pentest. It is a different question. A pentest goes deep on an agreed boundary and produces an audit-ready deliverable. An Adversarial Assessment establishes what the boundary actually is — which is the input a good pentest needs and almost never gets.

Put plainly: Adversarial Assessment tells you what to scope. The penetration test then tests the scope.

Free, and why that isn't a discount

THIS SERVICE IS FREE RIGHT NOW!

That is not a loss leader and it is not a race to the bottom. It follows the same logic as the rest of our model: when discovery and initial probing are executed by AI workflows under human review instead of by hand, the cost base collapses. External reconnaissance used to be a billable project phase because a person had to sit and do it for days. It no longer has to be.

There is a bigger shift behind it. Security testing has always been priced like specialist consulting, which meant the industry had a minimum engagement size below which nobody would pick up the phone. Everyone under that floor went untested, not because they had nothing worth protecting, but because the smallest assessment on offer costs more than what a small business on a tight budget could justify against a risk that had not materialised yet.

So they didn't test, and the sector called them underserved, and nothing changed for twenty years. AI has lowered the floor. When reconnaissance and probing run as codified workflows under human review instead of as billable hours, the cost of a first useful look drops by an order of magnitude.

When the entry price collapses, "everyone can test"; and knowing your own exposure moves from a luxury that mature organisations buy to a baseline that everyone running anything on the internet is expected to have. We think that is one of the more important consequences of AI in this industry. Not that testing gets cheaper for the companies already buying it, but that it finally reaches the ones who never could.

So we priced it at what it costs us, and for a limited time, it is free. We would rather you find out what you are exposing than not find out because a quote needed three approvals.

The truth, including when it's boring

Sometimes the honest answer is that nothing obvious is exposed.

When that is the answer, we will say so. We do not pad the report with informational findings to justify the exercise, and we do not inflate severity to make the report feel worth it. A vendor that always finds something is telling you about its incentives, not your security.

The limits, stated plainly:

This is the last of our founding story series. In subsequent posts we will start diving into the more technical aspects, and some actual performance stats from our tooling.

— End dispatch /