Run a real assessment whenever you ship, not once a year when an outside engagement is booked. You can also start one from the tools your team already uses, and bring the results back.
Autonomous security assessment you stay in command of.
ReconForge assesses your environment on its own and returns findings with clear fixes. Run it as a managed cloud service, or self-hosted, where it also proves what an attacker could exploit.
Why ReconForge
Security tested once a year is untested most of the year.
Your environment changes every week, but a yearly assessment only sees a single moment. ReconForge assesses on demand, whenever you want, so what you know about your exposure stays current.
Your team stops triaging a long list of maybes and works from a short list of issues that were already checked.
Every run is scoped to what you authorize, and everything it does is recorded and yours to review.
How it works
Three steps to launch. The platform does the expert work.
- 01
Choose a target and a template
Create a project and add the target you want assessed, whether that is a domain, a web application, a whole network, or a cloud account or Kubernetes cluster. Then choose a ready-made template: a look that never touches the target, a check of what is exposed, a review of a web application or an API, certificates, known weaknesses, how your cloud accounts or Kubernetes are set up, or, on self-hosted, private systems that are not on the public internet.
- 02
It runs the assessment
ReconForge works through the target on its own. It maps what is exposed and identifies weaknesses. Follow every step live as it happens, or leave it running and come back to the results. On self-hosted, you can choose a second run that safely proves which weaknesses an attacker could actually use.
- 03
You get proof and fixes
When it finishes, you get a clear report of everything it found, ranked by real-world risk so the most urgent issues stand out first. Each finding carries the evidence behind it and concrete steps to fix it, ready to share with your engineers or hand to an auditor. You can set a finding aside as not a real issue, or as a risk you accept, and it is left out of that later proof.
What you get
Answers you can trust, and the control to trust them
ReconForge is built to give a security program clarity without giving up oversight.
Proof, not just alerts
ReconForge does not stop at flagging issues. It ranks weaknesses by real-world risk, and on self-hosted it safely proves which of them an attacker could actually use, so your team spends its time on what matters.
Mapped to the standards you report on
Compliance checks are mapped to the frameworks your auditors use, including CIS, PCI DSS, HIPAA, and NIST, down to the specific control. Every finding is also tagged with its MITRE ATT&CK technique and OWASP category, so results drop straight into a compliance review or a threat report.
Evidence behind every finding
Each result carries the raw proof it came from and clear steps to fix it. Reports are built from what actually happened, ready to hand to engineering or an auditor without extra work.
A tamper-evident record of everything
Every action, including anything that was refused, is written to a sealed, append-only log that cannot be quietly altered. You always have a verifiable account of who did what, and when.
It only acts where you authorize
Each run is bound to the scope and rules you set, and target ownership is confirmed before anything begins. Testing is proof-of-concept only, so nothing ever happens outside the lines you draw.
Runs on your ground, under your sign-on
Run it self-hosted, air-gapped if you need to, with your own single sign-on and roles. Your systems and findings stay private, and each team stays fully isolated from the next.
Two ways to run it
Start in the cloud, or run it self-hosted.
Begin in minutes with the managed cloud, or run the full platform self-hosted when you need complete capability and total control over your data.
Cloud
Fastest to startThe fastest way to see where you are exposed. Fully managed, running the discovery assessment on the domains you own, so you can start in minutes.
- Runs the full discovery assessment, mapping what is exposed and surfacing weaknesses across your domains
- Assess your AWS, GCP, Azure, and Kubernetes posture by connecting a read-only credential
- Assess any domain you verify you own with a quick DNS record
- Nothing to install, fully managed, and always up to date
- Check your external exposure and cloud setup again whenever you want a fresh look
- You choose the AI it runs on
- Ask questions about your runs and findings in plain language
Self-hosted
Complete platformEverything ReconForge can do, on your own private installation. Built for regulated teams, internal networks, and anyone who cannot send their data to a third party.
- Everything the cloud does, and goes further: safely exploits each finding to prove the real impact, so you see what an attacker could actually do, not just that a flaw exists
- Assess internal networks and private systems by IP or range, not just public domains
- Your systems and findings stay private, with nothing sent out
- The AI you choose can stay private too
- Runs in air-gapped and restricted environments
- Installs in a few steps and connects to your own systems
- Ask it to look further, or to start and stop an assessment for you
Same platform, either side of your firewall. Move from cloud to self-hosted whenever you are ready.
Who it is for
One platform, several ways to put it to work
Small teams covering a lot
When a handful of people are responsible for everything the company ships, ReconForge covers the ground between releases that nobody has time to check by hand.
Service providers
Run every client from one place, each kept completely separate, and deliver reports backed by a full record of what was done rather than a summary you have to write from scratch.
Teams facing an audit
When an assessment date is set and the evidence is due, you can run one on demand instead of waiting weeks for an engagement window to open.
Organizations that cannot use SaaS
Some environments simply cannot send data to a third party, whether by policy, regulation, or because the systems are not on the internet at all. Those run it self-hosted.
See it run against your own targets.
Book a walkthrough and we will show you a real assessment from start to finish, with the proof and the fixes at the end.