Engagement modes
Before a mission launches you choose one of two modes. The mode sets the agent's whole posture: how aggressive it is, how far it exploits, and how much impact it tries to prove.
Auditor mode
Compliance-oriented and proportionate. The agent validates the controls that matter, prefers detection and evidence over deep exploitation, and stops at a proof of concept sufficient to raise a finding (for example: a version plus a known CVE plus a safe check). It avoids noisy brute force, mass exploitation, and aggressive lateral movement unless they are strictly required to confirm a control failure. Each check maps to a control objective — patching, exposure, authentication, encryption, least privilege.
Best for: compliance reviews, periodic security audits, and situations where production safety and proportionality come first.
Attacker mode
Maximum-depth adversary simulation. The agent behaves like a skilled attacker with a written mandate and pushes until nothing in scope remains. Even starting from only a URL or IP, it runs the full path — recon, enumeration, exploitation, chaining, and impact. It attempts every feasible in-scope technique, tests business logic deeply, chains findings toward account takeover, privilege escalation, and lateral movement, and prefers to prove impact with concrete evidence rather than stop at a "possible" vulnerability.
It still never causes irreversible damage — no data wiping, no ransomware-style behavior, and no denial-of-service that risks production unless scope explicitly allows it.
Best for: realistic red-team engagements where you want to know the true worst case.
Choosing a mode
| Auditor | Attacker | |
|---|---|---|
| Depth | Minimal proof of concept | Full exploitation |
| Chaining | Limited | Leak → takeover → privesc → pivot |
| Noise | Low, careful | High where scope allows |
| Goal | Confirm control failures | Prove maximum in-scope impact |
| Availability | Free trial & Pro | Pro only |
Auditor mode is available on the free trial (a limited number of audits) and on Pro. Attacker mode is a Pro feature. See Plans & licensing.
Each mode also picks a sensible default set of engagement cases, which you can adjust before launching.