Frequently Asked Questions

Hackurity provides Autonomous Red Teaming through the ART Stack. It continuously tests and validates how attackers could exploit trust, access, identities, integrations, applications, infrastructure and external platforms. It does not provide defensive monitoring, real-time alerting, blocking or incident response.

Rather than listing vulnerabilities, Hackurity proves which ones an attacker could actually use and how they connect into attack paths. Every finding is verified by our own red team before you see it.

Autonomous Red Teaming continuously simulates attacker behaviour to validate which weaknesses can be exploited, how attack paths connect, and what an attacker could actually reach. Unlike vulnerability scanning or periodic testing, it applies ongoing adversary pressure and uses validated exposure to guide remediation priorities.

Traditional testing validates one moment in time. Attackers exploit what changed afterwards.

Hackurity is built for organisations that own their security but have limited offensive capability. Typically mid-sized and small corporate organisations, often regulated or handling sensitive data, with a security or IT team accountable for exposure.

The people who buy Hackurity have security expertise. What they do not have is a standing red team, because offensive talent is scarce, expensive and hard to keep busy inside one organisation. That leaves a choice between an annual pentest, which is a snapshot, and a scanner, which never proves anything.

A scanner reports what exists. Hackurity proves what can be exploited and what it leads to. We safely exploit the weaknesses we find and chain them into the attack paths an adversary would actually use.

That difference changes what you do next. A scanner hands you thousands of findings ranked by severity score. Hackurity hands you a short list of exposures confirmed by exploitation, ordered by what an attacker could reach through them.

A penetration test is scoped, scheduled and finite. Hackurity runs continuously and re-tests as your environment changes, so a new release does not leave you relying on a test that has gone stale.

We also provide human-led manual testing quarterly alongside the autonomous stack, for the problems that need judgement rather than coverage.

Yes. All Hackurity products use AI to simulate attacker behaviour, exploit weaknesses and chain them into attack paths at a scale and frequency no human team could sustain. Every finding is then verified by our own red team.

Our red team confirms what is real, removes what is not, and adds the judgement and remediation guidance automation cannot provide. The human team is part of the red team, not a support layer.

Yes. One hundred per cent of Hackurity's technology, research and tooling is built in-house, with no dependency on third-party security platforms, scanners or outsourced capabilities.

That matters for two reasons. Our exploitation techniques are not limited by what a commercial scanner can detect, and there is no third-party vendor in the chain handling your findings. However, we also provide API access for integration with tools such as Rapid7, Tenable, CrowdStrike and ServiceNow.

Hackurity is headquartered in Rotterdam, the Netherlands, and was founded in 2021. We work with organisations across Europe, directly and through partners.

The ART Stack is Hackurity's set of autonomous red teaming products. Each covers a different stage of how an attacker approaches an organisation: exploiting and chaining weaknesses, tracking attacker preparation, and removing the assets used to impersonate you.

The products can be used separately, and they inform each other when used together. Intelligence about attacker preparation shapes what gets exploited, and validated exploitation shapes what gets prioritised.

Managed Autonomous Pentesting is autonomous penetration testing that runs continuously and proves what an attacker could reach, across external and internal attack paths. Autonomous penetration testing is what we used to call automated pentesting.

MAP safely simulates real attacks across external IPs, web applications, APIs and endpoints. Instead of stopping at discovery, it chains findings together to validate real attack paths using payload-less exploitation. Using the same architecture, it evaluates trust boundaries introduced through third-party software and updates, exposing how supply chain access could be abused.

Autonomous Threat Intelligence is dark web threat intelligence that shows when attackers are preparing to target you, before anything is attempted. It is not alerting or monitoring.

ATI correlates breach dumps, underground marketplaces, infrastructure scans, certificate transparency logs and grey-noise chatter into attacker-relevant risk profiles, showing who is being targeted, how impersonation could happen, and which identities or access points would be abused first.

Autonomous Brand Defence is OSINT brand protection that finds and removes the domains, services and communications attackers use to impersonate your organisation, your products or your executives.

That includes phishing infrastructure, fake services and brand abuse across the open web and messaging platforms. Once identified, Hackurity coordinates takedown and mitigation workflows. ABD is not reputation or sentiment management.

Yes. MAP, ATI and ABD can each be used independently, and many customers start with one.

They do reinforce each other. Intelligence about attacker preparation directs where exploitation effort goes, and proven attack paths show which impersonation routes actually matter.

Alongside the ART Stack, Hackurity provides manual penetration testing, social engineering campaigns, embedded systems testing and decoy and deception environments.

Embedded systems testing supports Cyber Resilience Act requirements and is built for manufacturing and product development. Decoy and deception environments suit larger organisations with complex infrastructure and threat intelligence needs.

Every engagement produces a business-contextualised risk report with prioritised remediation, alongside an interactive dashboard, an executive summary and a full technical report. API access is available.

MAP outputs validated vulnerabilities, the attack paths they combine into, the business impact, a human risk score and remediation guidance.

MAP follows six stages: target input, asset discovery, vulnerability identification, safe exploitation, post-exploitation and impact analysis, then a contextualised risk report.

You define scope by setting targets, which can be domains, IPs, applications, APIs or environments. We discover live assets, services and relationships, identify and validate exploitable weaknesses, exploit them safely to establish real impact, then map attack paths and escalate privileges to measure what an attacker could actually reach.

Payload-less exploitation proves a weakness is exploitable without deploying the malicious code a real attacker would use. Each exploit is strictly constrained to the specific weakness being tested.

This is how impact is demonstrated without putting production systems at risk. You get proof that an attack path works, and nothing is installed, altered or left behind.

Yes. Testing is payload-less and every exploit is constrained to the specific weakness being tested, so impact is proven without disrupting operations.

All testing runs within controlled parameters agreed with you. We run real attack chains, including privilege escalation and access to business systems, but the outcome is a confidential report rather than a breach.

MAP tests external IPs, web applications, APIs and endpoints, and can test internal environments through a lightweight agent. It also evaluates trust boundaries introduced by third-party software and updates.

Findings include exploitable web application weaknesses, network weaknesses, misconfigurations, outdated software, weak or exposed credentials, insecure API endpoints and supply chain access.

Yes. Internal testing works by deploying a Hackurity agent inside your network, which creates a secure connection back to our platform.

External testing needs no installation at all.

False positives are reduced by exploitation: we attempt to exploit each discovered weakness safely and verify it exists before reporting it, so you spend less time investigating non-issues. False negatives are addressed by continuity and human review.

Continuous exploitation-based testing catches issues that signature-based scanners miss, and every engagement is reviewed by our security team to close the gaps automation alone can overlook.

Findings are prioritised by proven exploitability and business impact rather than by severity score alone. We weigh whether a weakness is exploitable in your specific environment, what it leads to, and what an attacker could reach through it.

The point is to move you from thousands of findings to a handful of proven risks.

Testing is continuous rather than scheduled, and re-scopes itself as your environment changes. New deployments and infrastructure changes trigger fresh testing.

That is the difference between continuous validation and a point-in-time assessment: a release two weeks after a pentest does not leave you relying on findings that no longer describe your environment.

For external testing we need only the domain names or IP ranges you want assessed. Internal testing requires an agent and, depending on scope, limited controlled access, optionally including VPN access or credentials.

We follow the principle of least privilege in all testing.

All data is encrypted in transit and at rest, and engagement data is stored in the EU. Results are available only to authorised users in your organisation through our portal.

Hackurity holds ISO/IEC 27001:2022 certification. Further detail on subprocessors and data handling is published in our Trust Center.

Yes. Hackurity holds ISO/IEC 27001:2022 certification, certificate number 202505004, issued by Sancert and valid until 20 May 2027.

We do not currently hold SOC 2, FedRAMP or PCI QSA status.

Yes. Exploitation produces a confidential report delivered to you. Hackurity does not disclose, publish or otherwise share what we find in your environment.

Where we publish research, it is either our own original work or fully anonymised, and only with customer agreement.

Hackurity produces evidence supporting NIS2, DORA, ISO 27001, PCI DSS and GDPR, and our embedded systems testing supports Cyber Resilience Act requirements.

MAP supports evidence for NIS2, DORA, ISO 27001, PCI DSS and GDPR. ATI supports NIS2, DORA and ISO 27001. ABD supports GDPR.

No. No vendor can deliver compliance. Hackurity produces the testing evidence and documentation that several frameworks require, which your auditors and regulators then assess.

Most frameworks ask for the same core capabilities: asset visibility, vulnerability management, penetration testing, continuous assessment, threat intelligence, and evidence. Hackurity produces evidence across several at once.

You receive documentation of continuous security validation: what was tested, when, what was found, what was exploited and what was remediated.

For frameworks that require demonstrable ongoing assessment rather than an annual test, a continuous record is materially stronger than a point-in-time report.

Most customers are running within 24 to 48 hours. Onboarding focuses on identifying your key assets and launching an initial assessment.

The process has four steps: an onboarding call to understand your environment, configuration of your dashboard and testing policies, authorisation for the domains or IP ranges in scope, and your first assessment.

First results are typically available within hours of the initial assessment starting.

Those first findings give immediate visibility into what is exploitable, with remediation guidance attached.

No. Testing is designed to run without affecting system performance or stability, and onboarding requires limited time from your team.

External testing needs no installation. Internal testing needs one agent deployed in your environment.

Rather than a free trial, we run a proof of concept: our full solution against targets you choose, with the actual findings presented and verified on a consultation call.

Targets can include specific URLs, IP addresses, dark web sources or OSINT sources. You see real findings from your own environment rather than a demonstration account.

No. Findings are presented in clear language with specific remediation steps, and our red team is available to explain and prioritise them.

That said, Hackurity validates exposure rather than building a security programme from nothing. Organisations getting the most from it already have someone accountable for security.

Pricing is based on the size and complexity of your infrastructure, the number of assets in scope, testing frequency, and which ART Stack products you use.

We do not publish fixed packages because scope varies substantially between organisations. Contact us and we will quote against your actual environment.

No. Onboarding, technical support and platform updates are included in the quoted price.

Premium support with extended hours is available separately for organisations that need it.

We offer flexible terms. Annual agreements provide the best value, but we do not require long lock-in periods.

As your environment or requirements change, scope can be adjusted rather than renegotiated from scratch.

Yes. Special pricing is available for qualified startups, educational institutions and non-profit organisations. Contact our team for details.

Support includes technical assistance, help interpreting findings, and remediation guidance from our red team. The people answering are security practitioners, not a general help desk.

Every validated finding comes with remediation instructions specific to your environment, and our team stays involved until it is resolved.

Standard support runs Monday to Friday, 09:00 to 17:00 CET. Extended-hours and weekend coverage is available on premium support plans.

Support is available through the ticketing system in the portal, by email at support@hackurity.io, or by phone for urgent matters.

Premium support customers also have a dedicated security advisor and priority response.

Yes. Our red team will walk you through what was found, why it matters and what to fix first.

This is the point of human-backed red teaming: a report you cannot act on is not worth producing.

For critical exposures identified by our platform, premium support customers have access to escalated assistance.

Hackurity does not provide incident response. If you are dealing with an active breach, you need an incident response provider.