Research
Why your attack surface is bigger than your asset register
Most organisations defend what they know about. Adversaries attack what they can find. The difference is where breaches start.
7 min
01The continuous red team platform
See first.Move first.
Saluki runs automated red team operations against your live estate, continuously. Every verified path is routed to its owner, fixed and retested, with a Saluki operator behind each critical finding.
Hot075 this week
Mean time to fix3.2 d0.4 d
Hot exposures
LiveHot07Warm23Cool118
- Admin panel reachable from the internet2 min agoVerifiedvpn-02.brackwell.example
- Legacy API accepts expired tokens9 min agoTestingapi-legacy.brackwell.example
- New subdomain31 min agoWatchingpreview-14.brackwell-cloud.example
- Public storage bucket1 h agoRetestassets-eu.brackwell-cloud.example
- SSO metadata exposes internal host2 h agoTestingsso.brackwell.example
- Expired certificate on edge3 h agoWatchingcdn-03.brackwell-cloud.example
- Automated red team operations
- Operator-reviewed evidence
- Routed, fixed, retested
- Nothing to install
02The difference
A scanner tells you 4,000 things are vulnerable. Saluki shows you the seven paths that reach what you would lose.
Scanners list what is possible. Saluki pursues the objectives an adversary would, across identity, cloud and web, and proves which paths reach them. The rest stays on the list, watched, until it matters.
What a scanner sends you4,000 findings
- SC-3140InfoTLS 1.0 still enabled
- SC-3147LowDirectory listing enabled
- SC-3154LowCacheable HTTPS response
- SC-3161MediumSession cookie without HttpOnly
- SC-3168InfoDeprecated TLS renegotiation
- SC-3175LowMissing HSTS header
- SC-3182InfoWeak cipher suite offered
- SC-3189LowMissing Content-Security-Policy
- SC-3196LowEmail spoofing: SPF soft fail
- SC-3203MediumX-Content-Type-Options missing
- SC-3210InfoCookie set without the Secure flag
- SC-3217LowAutocomplete on a password field
- SC-3224InfoCertificate expires in 30 days
- SC-3231LowDMARC policy set to none
- SC-3238LowMixed content on landing page
- SC-3245MediumServer banner discloses version
- SC-3252InfoClickjacking header missing
- SC-3259LowOPTIONS method allowed
- SC-3266InfoOpen port 8443 on edge node
- SC-3273LowTrace method enabled
- SC-3280LowOutdated JavaScript library
- SC-3287MediumVerbose error page
- SC-3294InfoReferrer policy not set
- SC-3301LowSelf-signed certificate on test host
- SC-3308InfoMissing Content-Security-Policy
- SC-3315LowEmail spoofing: SPF soft fail
- SC-3322LowX-Content-Type-Options missing
- SC-3329MediumCookie set without the Secure flag
- SC-3336InfoAutocomplete on a password field
- SC-3343LowCertificate expires in 30 days
- SC-3350InfoDMARC policy set to none
- SC-3357LowMixed content on landing page
- SC-3364LowServer banner discloses version
- SC-3371MediumClickjacking header missing
- SC-3378InfoOPTIONS method allowed
- SC-3385LowOpen port 8443 on edge node
- SC-3392InfoTrace method enabled
- SC-3399LowOutdated JavaScript library
- SC-3406LowVerbose error page
- SC-3413MediumReferrer policy not set
- SC-3420InfoSelf-signed certificate on test host
- SC-3427LowTLS 1.0 still enabled
- SC-3434InfoDirectory listing enabled
- SC-3441LowCacheable HTTPS response
- SC-3448LowSession cookie without HttpOnly
- SC-3455MediumDeprecated TLS renegotiation
- SC-3462InfoMissing HSTS header
- SC-3469LowWeak cipher suite offered
and 3,952 morepage 1 of 160
What Saluki sends you07 paths
- 01Open the VPN administration consoleInternetStandard VPN accountAdmin consolevpn-02.brackwell.example91Verified
- 02Read tenant data with an expired tokenInternetLegacy APITenant recordsapi-legacy.brackwell.example86Testing
- 03List a storage bucket from the internetInternetPublic bucketCustomer exportsassets-eu.brackwell-cloud.example82Retest
- 04Map internal hosts from SSO metadataInternetSSO metadataInternal hostnamessso.brackwell.example78Testing
- 05Send mail as Brackwell through the relayInternetOpen relayStaff inboxesmx-02.brackwell.example74Verified
- 06Read production metrics without signing inInternetDashboardProduction telemetrygrafana.ops.brackwell.example71Retest
- 07Reach the corporate gateway from Harbour FleetHarbour Fleet (acquired)Shared identityGateway consolegateway-01.brackwell.example70Watching
03Automated red team operations
One operation, end to end.
Objective set.Path proven.Loop closed.
01Objective
Set the objective an adversary would.
Reach the admin console. Read another tenant's data. Cross from a supplier into the corporate estate. Saluki pursues it across identity, cloud and web, inside the rules you set.
Recon · Access · Escalate · Objective
02Proof
Prove the path, with evidence.
Each step is reproduced and the request and response are captured. A Saluki operator checks every critical finding before it is raised.
Reproduced 3 of 3 · No data changed
03Closure
Route it. Fix it. Retest it.
The finding becomes a Jira ticket with owner, heat and evidence. The team hears in Slack. Closing the ticket triggers the retest, and the board page records the result.
PLT-412 · Verified fixed in 1 d 23 h
04Intelligence-led targeting
LiveEvery exposure
has a temperature.
Heat is how Saluki decides where to go first. Saluki Labs tracks the actors and techniques aimed at your sector. Signal scores every exposure by likelihood, reachability and impact, and recomputes as the threat picture and your surface change. You get a short list, and the reason for every line.
Why PR-0917 is 91vpn-02.brackwell.example91Critical
- Likelihood94Admin consoles on VPN appliances are an active technique in your sector this quarter.
- Reachability88Internet-facing, and a standard account reaches it without a second check.
- Impact92The console reads tenant configuration for the whole corporate estate.
Exposures 148 · Hot 07 · Retesting 03 · Sweep 00:42
- Hot
Act now. A real adversary could use this today.
- Warm
Plan it. Reachable, but not yet proven or not yet cheap to exploit.
- Cool
We are watching. Known, monitored, and will warm the moment it matters.
05Remediation, built in
Use ours. Use yours. Or both.
Every verified finding arrives in Resolve with an owner, its heat and a fix plan Saluki writes: what to change, where, and how to confirm it. Run remediation in Saluki, in Jira, ServiceNow, Slack or Teams, or both at once. Status flows both ways: close the ticket and Saluki retests; mark it fixed in Saluki and the ticket closes.
- Ours
- Owner, priority, fix plan and retest, all inside Resolve.
- Yours
- The same finding as a Jira or ServiceNow ticket, a Slack or Teams thread, a PagerDuty page.
- Both
- Status flows both ways, so nobody updates two systems and nothing closes until the retest passes.
Close it in Jira and Saluki retests. Mark it fixed here and the ticket closes.
06Integrations
Findings go where your team already works.
Jira, ServiceNow, Slack, Microsoft Teams, Splunk, Sentinel, Okta, GitHub Actions, PagerDuty: by name, with an API and webhooks behind all of it. Routing rules decide who hears, where, and what happens when the ticket closes.
Verified findings travel out to your tools. A closed ticket travels back as a retest.
Routing rule
Webhook events
- finding.verifiedPursuit reproduced a finding and an operator cleared it.
- finding.routedA ticket was raised and an owner assigned.
- finding.fixedA retest passed and the finding closed.
- surface.changedSight found, lost or re-classified an asset.
- operation.startedA red team operation, campaign or retest batch began.
- retest.passedA retest ran from a clean session and the path no longer works.
07Safe by design
Built to run against production.
Scoped by you
You set the targets, the windows and the pace. The platform enforces them; nobody has to remember.
- Scope3 domains, 2 ranges
- Window22:00 to 06:00 UTC
- PaceLow
Non-destructive by default
Tests read, compare and reproduce. They never change a record, and they never run a payload that could.
No data changedFully auditable
Every action is logged with its evidence, so you can show exactly what was tested, when and how.
14:02:11 · pursuit · GET /admin · vpn-02 · 200 · evidence savedEnterprise access
Single sign-on, role-based access, API access and regional hosting options.
- SSO
- RBAC
- API
- Regional hosting
08Operators
Platform-first.
Operator-backed.
Autonomy gives you coverage. Operators give you certainty. Every critical finding is reviewed by a Saluki operator before it reaches you. When you need a full red team, an emulation campaign or a board briefing, the same team delivers it inside the platform.
Red Team Operations
Objective-based operations that test your people, process and technology the way a real adversary would.
Inside the platformThreat Intelligence
Know who is likely to target you, how they operate, and what that means for your defences, before it matters.
Inside the platformAdversary Emulation
Intelligence-led campaigns that replay the threat actors most relevant to you, mapped to MITRE ATT&CK.
Inside the platformStrategic Advisory
Board-level clarity on cyber risk, and programmes that turn findings into lasting change.
Inside the platform
Real-world attacks.Real insight.
The same operators who review your findings run the engagements. Nothing gets lost between a platform and a provider.
Saluki Labs
Research that moves first.
Original research, tooling and field notes from the people who build the platform and run the operations.
09
See it run against your estate.
Book a demo and we will map your surface live, then show you the first path that matters. Or start with a domain.