Platform
Proven means reproduced. Everything else is labelled.
ZerodayIQ maps your web app and APIs the way an attacker does, re-fires serious findings against a control request, and hands you replayable proof, exact fixes and a compliance-mapped report.
Only domains you verify · Non-destructive by default · First results in about 10 minutes
45
Scanner modules, recon to SSTI
16
AI agents, each owning one phase
~10
Minutes to first results (quick scan)
7
Compliance frameworks mapped
01The proof loop
Four steps between a maybe and a finding.
Most scanners stop at step two and hand you the maybes. ZerodayIQ keeps going until each serious finding is proven against the live target, or thrown out.
-
01
Map
Recon, crawling and API discovery build the attack surface: hosts, pages, forms, endpoints, parameters and scripts.
e.g. 1,284 requests · 9 hosts
-
02
Probe
45 scanner modules and the agent team raise candidates: injection, access control, authentication, exposure, known CVEs.
e.g. 317 possible issues
-
03
Prove
Each serious candidate is re-fired at the live target next to a control request. Different answers: proven, replay attached. Same answer: thrown out.
e.g. 200 ≠ 401
-
04
Review
A second AI judge checks every finding against its raw evidence before it reaches the report. What has no evidence is dropped.
e.g. 4 proven
Retest replays the same proof after your fix: 404, closed.
What a proof looks like
The attack and its control go side by side: same endpoint, one variable changed. If the answers differ, the finding is proven and the replay is attached, so anyone on your team can reproduce it with one request.
Serious findings can be independently reviewed by models from two different AI labs. If they disagree, we flag the finding for verification instead of stating it as fact.
Attack
GET /api/v2/invoices/88412 · tenant A’s session
200another tenant’s invoice
differs from
Control
Same request · no session
401Unauthorized
02Coverage ledger
A record of what we tested, not only what we found.
Every vulnerability class we test goes into the coverage ledger, including the ones that came back clean. Anything a WAF, a rate limit or an expired session blocked is marked inconclusive, never clean. The ledger is HMAC-signed by ZerodayIQ, so a later edit to it is detectable.
38 of 41vulnerability classes tested · 3 inconclusive · tamper-evident ledger
Illustrative example · ledgerly.io is fictional
| Class | Result | Evidence |
|---|---|---|
| BOLA / IDOR | Proven · 01 | Attack 200 ≠ control 401, replay attached |
| Secrets in JS bundles | Proven · 02 | Leaked key 200 ≠ no key 401 |
| SQL injection | Tested | 212 parameters, none injectable |
| Server-side request forgery | Tested | Response and timing probes, no difference |
| HTTP request smuggling | Inconclusive | Blocked by WAF after 3 probes |
ledger hmac-sha256 9f3c 1a7e 52b0 c4d9 … 07be e1a4 · signed by ZerodayIQ
03Attack chains
Findings, chained the way an attacker would.
Chain discovery links proven findings into multi-step attack paths, so you see which fix breaks the most paths. The attack-path graph scores blast radius and maps each step to MITRE ATT&CK.
-
02
Live staging key shipped in the JS bundle
valid key 200 · random key 401
-
03
Staging admin accepts the leaked key
leaked key 200 · no key 401
-
01
Other tenants’ invoices readable by ID
tenant B’s invoice 200 · no session 401
-
Impact
Every tenant’s payroll
Fix 02 first: it breaks the whole path.
Illustrative example · ledgerly.io is fictional
04Three ways in
One engagement, three ways in.
Verify your domain. That’s all an external scan needs. Authenticated and internal scans need credentials or the agent.
-
Door 01
External
Outside in. Black-box testing of your web app and APIs, the way an attacker first meets you. Add a login (form, JWT or OAuth) to test the authenticated surface, and a second account to test whether one user can reach another’s data.
Available -
Door 02
Internal
Inside out. A lightweight Docker agent on a host in your network maps what an insider or a breached laptop could reach: hosts, file shares, Active Directory, credentials, lateral movement and privilege escalation. Each internal engagement is reviewed and approved.
Available · approval required -
Door 03
Autonomous
Hands on. An AI that safely attempts real exploits against your verified targets, and stops at proof.
Early access
05CI and monitoring
Every release, re-tested.
Software ships every day. A pentest that runs once a year can’t keep up, so ZerodayIQ runs on a schedule and inside your pipeline, and only tells you what changed.
- ScheduleRe-scan automatically, as often as you need.1h6h12h24h48hWeekly
- Diff alertsEach run is compared with the last. Only new findings alert you, by Slack, webhook or email.
- CI/CDA build can trigger a scan through a webhook and gate the release on the result.
- RetestAfter a fix, the retest replays the original proof. If the attack no longer works, the finding closes.
06Chat with your report
Ask the report, not a chatbot.
Start a scan in plain English, then ask follow-ups: what to fix first, how a finding works, a curl command to reproduce it. Answers are grounded only in your stored scan, so the assistant can explain a finding but can’t add one the scan didn’t produce.
YouWhich finding should we fix first?
ZerodayIQFix 02, the staging key in /static/app.3f9c.js. It is the first link in the only attack path in this report (02 → 03 → 01). Rotate the key, then remove it from the bundle. Want the retest queued once it’s deployed?
Grounded in scan ledgerly.io · illustrative example
07Report and compliance
One report your auditor can read.
Every finding carries its evidence, a plain-language explanation, the exact fix, a CVSS 4.0 vector, CWE and MITRE ATT&CK references, and the controls it maps to. Mapped to, not certified: the report gives your auditor control IDs per finding.
- SOC 2
- ISO 27001:2022
- PCI DSS 4.0
- HIPAA
- GDPR
- NIST CSF 2.0
- OWASP Top 10
- + CWE · CVSS 4.0 · MITRE ATT&CK
45 scanner modules
| Family | Covers | Modules |
|---|---|---|
| Discovery | DNS, subdomains, CT logs, ports, TLS, APIs, exposed files | 10 |
| Web application | SQLi (sqlmap-confirmed), XSS, DOM XSS, SSRF, SSTI, CSRF, smuggling | 14 |
| API and auth | BOLA, GraphQL, JWT, OAuth, WebSocket, OpenAPI fuzzing | 6 |
| Known vulns, secrets | Nuclei, CVE matching, vulnerable JS libraries, leaked keys | 5 |
| Infrastructure | Email spoofing, cloud buckets, WAF, subdomain takeover | 5 |
| Threat intel | OSINT, breach data, information disclosure | 5 |
16 AI agents
| Role | Agents | Count |
|---|---|---|
| External | Recon, Enumeration, WAF, Vulnerability, Exploit, Validator, Report | 7 |
| Internal | Network discovery, Active Directory, Credentials, Lateral movement, Privilege escalation | 5 |
| Synthesis | Attack path, Blast radius, MITRE mapper | 3 |
| Director | Adaptive deep-dive: picks the next tool from live evidence | 1 |
Your turn
See the proof on your own site.
Only domains you own and verify · quick scan in about 10 minutes · Book a demo