Now accepting applications for IMDA GenAIxDL Quick Win

Learn more →

Hadrian's Vigil

hadrian — scan
$ hadrian scan --target [redacted].com
[+] Subdomain enumeration 739 discovered
[+] Live surface mapping 412 responding
[+] Credential hunt 2 API key pairs (GitHub)
[+] API policy analysis cross-origin misconfiguration detected
[+] Session architecture cookie flags misconfigured
[+] Dangling asset CNAME pointing to unclaimed external resource
[!] Chain detected:
3 medium findings → single critical exploit path
→ account takeover, no victim interaction required
[!] Estimated exposure: EUR 620M – 2.5B
[!] Severity: CRITICAL (CVSS 9.8)
█
scroll

Your attack surface is bigger than you think.

And growing faster than your team can track.

Shadow IT sprawl

Every new SaaS tool, regional microsite, and API integration expands your perimeter. Most of it is unmapped.

Pentests are snapshots

A two-week engagement captures your surface on one day. Your attackers check every day.

Findings without context

A list of CVEs doesn't tell your board what's at stake. Individual findings understate chain risk by 10–100×.

The Pipeline

From Surface Discovery to Hardened Posture

DISCOVER
SYNTHESIZE
HARDEN

How Hadrian works

DISCOVER

Map your entire attack surface

AI agents enumerate subdomains, APIs, credentials, cookies, CORS policies, and misconfigurations. We discover what your pentest missed — in hours, not weeks.

hadrian — surface-scan
$ hadrian scan --target acme.corp --deep
[+] Resolving root domain: acme.corp
→ 4 A records, 2 CNAME chains
[+] Subdomain enumeration complete
→ api.acme.corp [200 OK]
→ staging.acme.corp [200 OK]
→ dev-legacy.acme.corp [200 OK]
→ auth.acme.corp [200 OK]
→ internal.acme.corp [401]
[!] CORS misconfiguration — api.acme.corp
Origin: null allowed (wildcard + creds)
[!] Dangling DNS — legacy-cdn.acme.corp
[!] Exposed .env — staging.acme.corp/.env
[+] Cookie audit: 12 session tokens
→ 9 missing Secure flag
→ 7 missing HttpOnly flag
Scan complete. 47 findings. 3 critical.
█
SYNTHESIZE

Chain findings into critical exploits

Individual findings understate risk by 10-100x. Our AI correlates disparate issues into multi-step attack chains with CVSS scoring and financial exposure modeling.

INDIVIDUAL FINDINGS

F-01Dangling DNSCVSS 4.3
F-02CORS wildcardCVSS 5.8
F-03Exposed .env keyCVSS 7.2

AI correlation

CRITICAL CHAIN — CVSS 9.1Full Account Takeover
1Claim dangling DNS → point to attacker host
2CORS wildcard + null origin → steal session token
3.env key → authenticate as internal service
HARDEN

Fix it. Prove it. Automatically.

AI agents apply fixes directly — CSP tightening, header hardening, session cookie fixes, dangling DNS cleanup — with regression tests verifying each fix holds. Posture score: before and after.

POSTURE SCORE

42BEFORE
94AFTER

APPLIED FIXES

CSP header enforced
Secure + HttpOnly cookies
Dangling DNS record removed
CORS policy restricted
Regression tests passing

What Hadrian covers.

Autonomous Recon

Subdomain enumeration, DNS mapping, historical URL discovery, API surface identification, credential hunting across public sources.

Two ways to engage.

Platform

For teams with security engineers.

  • Continuous automated monitoring
  • Real-time dashboard & alerting
  • Full API access
  • Delta reports on new findings
  • SIEM & webhook integrations
  • Self-serve onboarding
RECOMMENDED

Managed

For organizations that want expert-led offensive security.

  • Deep scoped engagements
  • Custom attack chain scenarios
  • Executive CISO briefings
  • Remediation guidance & verification
  • Multi-domain & subsidiary coverage
  • Direct security team access
Recent engagement — identity anonymized

One engagement. One chain. Billions in exposure.

739Subdomains discovered
38Findings identified
5→1Findings chained into one critical exploit
€620M–2.5BEstimated exposure

“Hadrian discovered a critical vulnerability chain across 739 subdomains that exposed the PII, payment methods, and digital wallets of millions of customers — with full read-write access to their accounts. Their existing pentest vendor had found nothing.”

Three individually Medium-severity findings across DNS infrastructure, API configuration, and session management. One Critical chain. Their existing pentest vendor had found none of them.

Built for engineers who know what they're looking at.

hadrian API
$ hadrian scan --target example.com --mode deep --output json

{
  "target": "example.com",
  "subdomains": 739,
  "findings": 38,
  "chains": [
    {
      "id": "CHN-001",
      "severity": "CRITICAL",
      "cvss": 9.8,
      "components": [
        "API origin policy misconfiguration",
        "Dangling DNS asset → unclaimed external provider",
        "Session cookie flag misconfiguration"
      ],
      "impact": "Cross-origin account takeover — no victim interaction required",
      "exposure_eur": { "low": 620000000, "high": 2500000000 }
    }
  ]
}

Full API docs available after access is granted. Webhook, SIEM, and CI/CD integrations included.

See what your pentest missed.

Most engagements surface something critical within 48 hours.

Request Platform Access