Autonomous Offensive Security
Metnir is an offensive security lab. We build autonomous systems that find and exploit vulnerabilities in real-world software, and work with the teams behind it to fix them.
Our researchers have reported vulnerabilities to
- QEMU
Built for Engineering Teams
The first attack on your product should be ours.
Before a launch
Have the release attacked while it is still yours to change.
After a rewrite
A new service or permission model moves the edges of your system. Test where they moved.
Before the security questionnaire
Walk into your customer’s review with a recent assessment in hand.
After an incident
Find out how far the reported issue reaches, and what else sits next to it.
What We Assess
Applications
Sign in as a customer. Leave as an admin.
Agents use your web application and its APIs the way real users do, then go looking for everything those users were never meant to reach.
Source
Read every line. Then run it.
Where you share source, agents read it alongside the running system and try what they find in the code against the real thing.
Native
One byte past the end of the buffer.
Agents work through native and low-level code, looking for the memory errors that end in code execution.
Continuous
Then again on the next release.
Software changes every week. After a first assessment, Metnir can follow your releases and test what is new.
Latest Publications
VIEW ALL
Tell us what to attack.
Point us at a system and we’ll get back to you as soon as possible.