​Latchkey is our autonomous penetration testing and attack surface monitoring that reports only what an attacker could actually exploit.
​Real offensive tradecraft running unattended inside your network. No scanner noise. No thousand line reports of theoretical findings. Just the handful of things that would get you breached, each one proven by exploitation.
​
Access starts with a short call, because we verify who you are and what you own before we hand over a tool that runs real attacks.
Scanners bury you in findings that do not matter
​​Traditional vulnerability assessment flags everything it can see and inflates the severity of most of it. Unreachable services, unauthenticated banners, false positives your team spends weeks triaging. You end up staring at a spreadsheet of five hundred items while the two paths that actually lead to domain admin sit quietly in the middle of it.
​
A CVSS score is not an attack. A flagged version string is not a breach. You do not need a longer list. You need to know what an adversary would do with what you have.​
​
Severity is not exploitability
A scanner finds a service running a version with a critical rating. There is no working exploit for it in your configuration, nothing reachable touches the affected function, and it sits at the top of your report for six months because the number is high.
​
Latchkey does not stop at the version string. It pulls the candidate exploits for that service, checks whether they actually work against the host in front of it, and only then decides the finding is real. If it fires and lands, you have a confirmed path. If it checks and fails, the finding drops. What you are left with is the set that an attacker could actually use, not the set a database says might apply.
Attackers do not take vulnerabilities one at a time
​The finding that ends up in a breach report is rarely the one that scored highest. It is usually three things that each looked survivable on their own. A medium severity issue on a host nobody considered sensitive, a service account with more rights than anyone remembered granting, and a trust relationship between two systems that made sense when it was built.
​
Ranked individually, none of those get fixed this quarter. Chained together they reach the data. That gap between a list of vulnerabilities and your real exposure is the entire reason exposure management is displacing vulnerability management, and it is the gap Latchkey is built to close.
​
Latchkey runs the chain. It discovers what is live, finds what is exploitable, proves it by exploiting it, captures the access, and shows you where the path ended up. It does not report the first link and leave you to imagine the rest.​
Autonomous Penetration Testing
Latchkey discovers live hosts across your authorized ranges, fingerprints every service, and identifies the ones carrying real exposure. It assembles the exploits that match, filters out anything unreliable or destructive, verifies each one against the target, and fires only at what it has confirmed it can reach. It captures unauthenticated access, weak and default credentials, and exposed services, then follows what it lands into the network the way an operator would.
Every system it compromises is a system it proved, not a version number it flagged.​
Attack Surface Management
Latchkey maps what you look like from the outside and watches it for change. Subdomains and certificates, exposed cloud storage across S3, Azure, and GCP, DNS and email security posture, technology stack, cloud tenant and identity provider attribution, leaked secrets in public code, and credentials showing up in breach data.
It establishes a baseline on the first run and flags anything new against it, so the subdomain that appeared last week and the storage bucket someone left open this morning surface before an attacker finds them.
It runs the attack, not the checklist.
The first tells you what an adversary can do with what you have right now. The second tells you the moment that changes.
​​​
Latchkey orchestrates the tooling a real operator uses, discovery, service and version detection, exploitation, credential attacks, web application testing, and post exploitation, into one pipeline that runs end to end without anyone driving it. Nobody babysits a console. Nobody stitches tools together. Nobody correlates output across five terminals at midnight.
​​
Deciding what is worth attacking, which exploit to try, whether it actually worked, and where to go next is the judgment an operator brings to an engagement, and that is what we built into the pipeline. It comes from the same work we do on live red team engagements, and when we learn something in the field that makes the engine sharper, it goes into the product.
​
If it cannot be exploited, it does not get reported Every finding is validated by exploiting it, not inferred from a version number. You get a short, ranked list of proven attack paths. Each one comes with the evidence, the real world impact, and the fix.
​
Nothing unreliable fires. The engine checks before it exploits and only advances on what it can prove, so a run tells you what an attacker reaches, not what one might theoretically try. No padding to make the report look thorough. If an attacker could not use it, it does not make the report.
​
We verify before we hand over the keys Latchkey runs real attacks against real systems. Anyone willing to sell that to a stranger with a credit card and no questions asked is not somebody you should be buying offensive tooling from.
​
So access starts with a conversation. We confirm who you are, we confirm the assets you want tested actually belong to you or that you hold written permission to test them, and we get authorization documented before anything runs. It takes one short call.
​
That call is also where we tell you honestly whether Latchkey fits your environment. Sometimes the answer is that what you need is a human engagement instead, and we would rather say so upfront than take a subscription that was never going to help you.
​
How Does it Work?
A virtual appliance drops into your network on your hypervisor and runs on your hardware, which is why internal testing costs what it costs. It ships sealed. No shell, no console and no config files to edit. Your authorized ranges are issued as a signed manifest tied to your license, and any target outside it is rejected before a packet leaves the box.
​
Your findings never leave. The appliance serves its own portal on your LAN where you read the proven paths, pull the evidence, and export what you need. We do not store your findings, your topology, or your attack paths, because we do not want a copy of the fastest way into your environment any more than you want us to have one.
The appliance reports its license and scope status back to us and nothing about what it found. And because we know what a well placed appliance is worth to an attacker, we scan its codebase nightly and test it by hand the way we test our clients.
​
Who needs it?
-
Teams without a full time offensive capability who still need to know their real exposure.
-
Engineers who refuse to wait for the annual pentest to find out an attacker already had a way in.
-
Security leaders stuck between a quarterly scan that finds nothing useful and an annual engagement that finds everything eleven months too late.
​
Latchkey finds the technical paths an adversary would take through your infrastructure. It does not walk into your lobby, call your help desk, or tell you what a determined human does with a work order and a high visibility vest. Automated testing tells you what is reachable. It cannot tell you what happens when someone decides to try. When you need that answer, Penetration Testing or Active Threat Emulation Testing are where the people come in.
​
See the attacks that matter, proven and ranked, in plain language. Access starts with a short call, because Latchkey runs real attacks and we verify who you are and what you own before we hand it over.
​
Common Questions
-
Is this a vulnerability scanner?
-
No. A scanner lists what might be wrong. Latchkey proves what an attacker can actually do.
-
-
How is this different from the enterprise validation platforms?
-
Price and provenance. Those platforms are six figure purchases that sit in procurement for a quarter before anyone runs a test. We are a fraction of that, and everything we learn on live red team engagements feeds the product.
-
-
Why can I not just sign up?
-
Because Latchkey runs real attacks. We verify identity and asset ownership and get authorization documented before licensing an appliance. One short call, once.
-
-
Will it break something?
-
Exploitation is real, so it can cause state change. Treat a run the way you would treat any authorized test against production, with a window and a rollback plan if the environment is fragile.
-
-
Does this replace a penetration test or a red team engagement?
-
No. Latchkey runs real exploitation across your technical attack surface, but a human penetration tester chains context a machine does not, chasing business logic flaws, judgment calls, and the odd path that only makes sense once you understand what the target is worth.
-
A red team goes further and adds the people, the buildings, and the pretext that gets someone through a door. Latchkey is the continuous technical layer underneath both, not a substitute for either.
-