The platform
The Veync Engine
An autonomous adversary that plans, executes and verifies attacker actions against your environment — confined to a scope you authorize, and recording exactly what proved each result.
Autonomous adversary fabric
Agents that plan and chain actions, not scripts that replay them
A scenario library can only exercise what someone already wrote down. Veync's agents reason about your environment, chain actions across layers, and adapt when a step fails — which is where undetected paths are found.
01
Planning and execution
A planner decomposes an objective into candidate paths, then reconnaissance, exploitation and AI-layer agents execute them and feed results back so the next step is chosen from what actually happened.
Failure is signal: a blocked step narrows the search rather than ending the run.
02
Confinement, not best effort
Every action is checked against the authorized scope before it executes, so autonomy never means unbounded reach. The boundary is enforced in the control plane, not inside the agents it governs.
An agent cannot widen its own scope, because it is not the component that holds it.
03
Proof, not narration
Each executed action is recorded with its inputs, its result and the artefacts it produced, so a verdict carries its own justification rather than a summary written afterwards.
Any finding can be re-read, re-run and compared with a later run.
04
Re-run on change
Validation re-runs when the system changes rather than on a calendar, so a verdict describes the configuration you are running rather than the one you were running last quarter.
A new agent, tool permission or detection change is a trigger, not a note for next year.
Architecture
Four layers, and the boundary between them
The operator authorizes. The control plane confines. The agents execute. The evidence layer records. Separating them is what makes autonomous offensive testing safe enough to run against a production estate.
Four layers. The operator defines rules of engagement. The control plane holds those rules, enforces scope, and provides a kill switch. Adversary agents — a planner, reconnaissance, exploitation, an AI-layer adversary and a verifier — execute only what the control plane permits. The evidence layer records an audit trail and builds the evidence graph from verified results.
Operator
- Operator
Control plane
- Rules of engagement
- Scope enforcer
- Kill switch
Adversary agents
- Planner
- Reconnaissance
- Exploitation
- AI adversary
- Verifier
Evidence
- Audit trail
- Evidence graph
Authorization control plane
The part you should audit first
Autonomous offensive tooling is only acceptable if its limits are structural. These are the five invariants the control plane holds, and the component that holds each one.
- Nothing executes outside the agreed scope
- Targets, networks, identities, tenants and agent endpoints are enumerated before a run and checked on every action. An action against anything not on the list is refused and logged.Enforced byScope enforcer
- Rules of engagement are machine-readable
- Permitted techniques, excluded systems, time windows and escalation paths are configuration rather than a PDF, so the run cannot drift from what was signed.Enforced byRules of engagement
- Blast radius is bounded in advance
- Destructive and high-impact classes of action are off by default and enabled only per engagement, with a ceiling on concurrency and on changes to any single system.Enforced byScope enforcer
- A single stop that actually stops
- One control halts planning, in-flight execution and queued work, and revokes the credentials issued for the run. It is exercised as part of onboarding rather than assumed.Enforced byKill switch
- Every action is attributable
- Each executed action records who authorized it, which rule permitted it, when it ran and what it touched, so your own SOC can reconcile Veync activity against real attacker activity.Enforced byAudit trail
None of these are agent-side behaviours. An agent asks the control plane whether an action is permitted and receives an answer; it has no path to the decision.
Evidence graph
A verdict that carries its own proof
The difference between a finding and an assertion is traceability. Every verdict in Veync resolves back through the artefacts that produced it to the exact action that was executed.
01
Executed action
The concrete step an agent took, with its parameters, its timestamp and the scope rule that permitted it.
02
Artefact
What the action produced: a response, a transcript, a session, a written file, a telemetry record or its absence.
03
Verdict
The judgement the artefacts support — prevented, detected, alerted or missed — with the reasoning retained rather than summarised away.
04
Obligation
The control, framework clause or regulatory obligation the verdict speaks to, so the evidence is usable in an audit without translation.
This is also what makes a re-run meaningful: because a verdict is anchored to an action, the same action can be replayed after remediation and the two results compared directly.
Continuous operation
A verdict has a shelf life
An assessment describes a configuration at a moment. Estates change continuously, and the changes that matter most to detection are routine enough that nobody reports them.
What triggers a re-run
- A new agent or tool permission
- A model or provider change
- A detection rule edit
- A control upgrade or policy change
- A new exclusion
- An identity or tenant change
- A new external service
- A published technique worth exercising
The practical effect is that the question changes from "when was this last tested" to "has anything changed since it was last proved" — which is the question a board can actually act on.
Deployment
Three deployment models
The constraint is usually not technical but contractual: where evidence may be stored and who may hold the credentials. All three models run the same engine and produce the same evidence.
| Dimension | Managed (EU) | Private cloud | Self-hosted |
|---|---|---|---|
| Data residency | EU regions only | Your tenant, your region | Your infrastructure |
| Agent execution | Veync-operated | Your tenant, Veync-operated | Your operators |
| Evidence storage | Veync, EU-hosted | Your tenant | Your storage |
| Credential custody | Scoped, issued per run | Scoped, issued per run | Never leaves your estate |
| Integration | SIEM, ticketing, SSO | SIEM, ticketing, SSO | SIEM, ticketing, SSO |
| Typical onboarding | Fastest | Moderate | Longest |
Data residency
EU-hosted by default
Validation evidence is a detailed map of where your defences fail. It is among the most sensitive data you will ever hand to a vendor, and it is treated accordingly.
- Processed and stored in the EU
- Evidence, telemetry and run records stay in EU regions. There is no replication to a non-EU region for convenience.
- Named access only
- Access is restricted to named personnel on your engagement, logged, and revoked when the engagement ends.
- Retention you set
- Retention is contractual rather than default, with deletion on request and a certificate of destruction.
- Disclosed subprocessors
- The subprocessor list is part of the agreement and changes are notified, not discovered.
Lawful use
Authorization is the first control
Offensive capability without written authorization is not a product, it is a liability. This posture is not a disclaimer at the bottom of the page; it is the reason the control plane exists.
What is agreed before a run
- The accountable owner who authorizes the engagement
- The enumerated systems, identities and agent endpoints in scope
- The systems explicitly excluded
- Permitted and prohibited technique classes
- Time windows and concurrency ceilings
- The escalation path and named contacts
- Evidence handling, residency and retention
- The conditions under which the run is stopped
Validation modules
What the engine validates
Seven modules, one engine. Each answers a question a board can ask and an auditor can follow.
AI Governance Assurance
Tests whether declared AI governance is enforced in the running system, not only documented.
Guardrail Integrity Testing
Measures whether model and agent guardrails hold under sustained adversarial pressure.
Agentic Risk and Authorization
Probes agent permissions, authorization boundaries and scope confinement for excessive agency.
Security Control Validation
Shows whether deployed control categories prevent, detect, alert on or miss real attacker actions.
Framework Alignment and Gap Analysis
Maps validation evidence to the frameworks you are accountable to, and names the gaps.
AI-Generated Code Security
Finds exploitable defects in AI-written code and its dependencies, with proof of exploitability.
Autonomous Offensive Operations
Assume-breach adversary emulation across the kill chain, under written rules of engagement.
Questions
What engineering teams ask
How do you stop an autonomous agent exceeding its scope?
Scope is not an agent-side behaviour. Every action is checked against the authorized scope by the control plane before it executes, and an agent has no path to that decision — it receives a permitted or refused answer. Refusals are logged alongside executed actions.
What happens if something goes wrong mid-run?
A single kill switch halts planning, in-flight execution and queued work, and revokes the credentials issued for the run. It is exercised during onboarding rather than assumed to work, and the escalation path and named contacts are agreed before the first run.
Will this generate noise in our SOC?
It should, and that is part of the measurement. Every executed action is attributable, so your team can reconcile Veync activity against real activity afterwards. Whether your detections fired at all is one of the outputs.
Can we run it ourselves?
Yes. The self-hosted model keeps execution, evidence and credentials entirely inside your estate, with your operators running the engine. It takes the longest to onboard and produces the same evidence as the managed model.
Where does our evidence live?
In EU regions by default, with named access only, contractual retention, deletion on request and a disclosed subprocessor list. In the private-cloud and self-hosted models it never leaves your tenant or your infrastructure at all.
See the engine against your environment
A validation briefing walks through your estate, the scope we would authorize, the deployment model that fits your constraints, and the evidence you would receive.
Named-vendor results and control-evasion evidence are shared under NDA, through the evidence annex.