MainAI 
Gary Todd · Wikimedia CommonsCC0
01 · The terrain
We map the public surface first.
Domains, services, versions, ways in. No guesses, no noise.
MainAI Cyber · authorised attack
Surface + deep · evidence for every finding
Know the terrain.
First.
We find what an attacker would see first — with written permission, evidence for every finding and a plan that can close the gaps.
No obligation · we only start after a written mandate
100–1000s agents in parallel
1–100+ domains
0 writes by default
Fixed price after scope
Surface and depth.Public services and internal systems. Ranked by risk.
Evidence, not noise.Every finding has a path that can be repeated.
Safe harbour.Written permission, clear scope, stop conditions.
Report and free re-test.You get the fix verified.
“Know the enemy and know yourself; in a hundred battles you will never be in peril.”Sun Tzu · The Art of War · trans. Lionel Giles, 1910
The doctrine
The terrain.
The messenger.
The gaze.
The Art of War is not a slogan. It is the order: understand the ground, send the right messenger, see everything — and only let go when the evidence is there. We do it with permission.
Gary Todd · Wikimedia CommonsCC0
Rijksmuseum · RP-P-OB-71.061CC0
02 · The messenger
One role. One trace.
The agents run in parallel, but each has a narrow scope and an audit trail.
Rijksmuseum · RP-P-2014-34-12ACC0
03 · The gaze
Hundreds of eyes. One terrain.
Surface and depth. Findings ranked by risk, not by noise.
A run
See what an attacker sees.
An illustrative domain. Start the swarm and watch findings arrive — surface to depth. Nothing here leaves the page.
Ready · 0/4 findings
Authorised · lab
> Waiting to start. Scope read. 4 agent roles ready.
> Illustrative view · all findings and evidence shown.
Findings0/4
Press start. Findings appear here as they are validated.
Admin without MFA
A public admin login accepts passwords without a second factor and with no lockout.
GET /admin HTTP/1.1
Host: beta.nordhavn.dk
→ 200 · login · no MFA
→ 5 attempts/sec · no lockout
FixEnable MFA and rate-limit the login.
Ready for re-testIDOR in invoice API
An object lookup does not check tenant. Customer A can fetch customer B’s invoice by changing the id.
GET /v1/invoices/1042
Authorization: Bearer <customer-A>
→ 200 application/pdf
→ customer-B’s invoice
FixCheck tenant id on every object lookup.
Re-test scheduledTLS expires in 9 days
The certificate expires soon and there is no automatic renewal.
notAfter=2026-11-04T09:14Z
issuer=Let’s Encrypt
auto-renew=none
FixRenew the certificate and monitor expiry.
Ready for re-testSource map exposed
The production source map is public and exposes source code and internal paths.
GET /assets/app.js.map
→ 200 application/json
→ 1,842 source lines
FixRemove .map from production or put it behind auth.
Not scheduledReport ready · 4 findings
See report excerptIllustrative run · findings, services and numbers are examples, not a customer run.
The report
Finding. Evidence. Fix.
This is how we deliver. An excerpt of the illustrative report — every finding with affected service, evidence, fix and re-test.
REPORT · CYB-261026-NORDHAVNIllustrative excerpt · edited
4findings
1critical
100%with evidence
0data changed
Admin without MFA
beta.nordhavn.dk/admin · depthEvidence
GET /admin → 200 · login
no MFA · no lockout
5 attempts/secA public admin login accepts passwords without a second factor and with no lockout.
Fix and re-test
Enable MFA and rate-limit the login.
Ready for re-testIDOR in invoice API
api.nordhavn.dk/v1/invoices/1042 · depthEvidence
GET /v1/invoices/1042
Bearer <customer-A> → 200
customer-B’s PDFAn object lookup does not check tenant. Customer A can fetch customer B’s invoice by changing the id.
Fix and re-test
Check tenant id on every object lookup.
Re-test scheduledTLS expires in 9 days
nordhavn.dk:443 · surfaceEvidence
notAfter=2026-11-04T09:14Z
auto-renew=noneThe certificate expires soon and there is no automatic renewal.
Fix and re-test
Renew the certificate and monitor expiry.
Ready for re-testSource map exposed
app.nordhavn.dk/assets/app.js.map · surfaceEvidence
GET /assets/app.js.map → 200
application/json · 1,842 linesThe production source map is public and exposes source code and internal paths.
Fix and re-test
Remove .map from production or put it behind auth.
Not scheduledRe-test: 2 ready · 1 scheduled · 1 not scheduledNo customer data · example only
MainAI Cyber · the platform
We release the swarm.
You get the map.
The MainAI Cyber model is open and cyber-trained. It orchestrates hundreds of agents on the box — each with a role, a scope and a trace. No data leaves the house to think.
Rijksmuseum · RP-P-2014-34-12ACC0
01 · The model
Open. Cyber-trained. On the box.
Our own state-of-the-art model, open source and trained to see like an attacker. Inference runs privately.
open sourceon-boxinference
no third party
02 · The swarm
Hundreds of roles. One terrain.
100–1000s agents in parallel: discovery, validation, evidence and ranking. Every agent has a narrow scope.
surfacedeepinternal
scope per agent
03 · The evidence
Findings that can be checked.
A repeatable path, affected service, low-risk fix and one free re-test. No loose claims.
evidencefixretest
delivery
For SMEs and enterprises. Fixed price after agreed scope. Everything runs on the box.
Discuss a runLevels
One domain.
Or the whole company.
Same engine. Different terrain. Every run is a fixed price after scope — and every run ends with report, evidence and one free re-test.
Single domain
For SMEsOne public domain. Surface and depth. You get a clear picture before anyone else does.
- One domain and its public services
- Report, evidence and one free re-test
- Fixed price after scope
Enterprise · surface
Multiple domainsYour public face: domains, apps and services. The swarm ranks by risk, not by sequence.
- 2–100+ domains and services
- Prioritised report and one free re-test
- Fixed price after scope
Enterprise · internal
Internal servicesWhat cannot be seen from outside. Via on-prem agent or VPN — same model, same evidence.
- On-prem agent or bounded VPN
- Internal services and architecture
- Report, evidence and one free re-test
No amounts on this page: scope and fixed price are agreed before the swarm is released.
The method
Five steps. No blind spots.
We move from agreement to evidence in an order that can be checked. Every step has an output, and no step is skipped.
Agreement and scope
Domains, services, window and stop conditions.
scope.md · auth.pdfSurface
DNS, TLS, headers, services, versions and ways in.
dns · tls · pathsDepth
Auth, IDOR, injection, SSRF, business logic and secrets.
auth · idor · logicReport
Evidence, severity, affected service, fix and raw logs.
evidence · severityRe-test
We verify the fix and close or reopen. One re-test is free.
retest · closed
The terrain
Web. API. Mobile backend. Internal services. Cloud. Legacy. And whatever you most want proven.
Public
DNS · TLS · headers · services · versions · paths
Deep
auth · sessions · IDOR · injection · SSRF · logic
Evidence
request/response · logs · screenshots · hash · timestamp
Delivery
prioritised report · fix · re-test · raw logs
Why it holds
One layer at a time.
Always agreed.
The swarm is large, but the boundaries are small. We read first, write only by agreement, and stop if anything moves.
Read first
We do not write to production unless you ask. Read-only is the default.
Scope per agent
Each agent is allowed only its own small area. No free hand.
Stop conditions
Critical findings, outages or doubt: we stop and ask before moving on.
Safe harbour
White hat.
In writing.
We only go where you have given us the key. Everything else is out of scope. That is how we keep the test calm, even when it is sharp.
01
Written permission
A signed scope before the first request. No verbal grey zones.
02
Known window
Dates and times agreed in advance. No surprises in operating hours.
03
Stop conditions
Critical findings, outages or doubt: the swarm stops and you hear from us.
04
Data stays on the box
Models, logs and findings stay in the house. No third party, no cloud.
05
No third party
No CDNs, analytics or external APIs in the run.
White hat · responsible disclosure · re-testDiscuss safe harbour
Partners
Auditors. Lawyers. Security firms.
They can deliver our run under their own name. We deliver the model, the swarm and the evidence.
Start
A short chat.
No obligation.
Tell us briefly what you want clarity on. We come back with the next step — not an invoice. A chat does not start a run.
- 0115 min: terrain, goal and limits.
- 02Scope and fixed price, only if you want to continue.
- 03Run, report and one free re-test.