# CYBRET

> Continuous pentesting for authorized targets. Black, Grey, and White coverage. Exploitable findings only, with replay evidence. Cover, prove, ship.

CYBRET is a continuous pentesting platform. Point it at a registered site, choose the hosts in scope, and test with the right depth: Black (external, zero credentials), Grey (authenticated user context), or White (source and architecture context). Findings are kept only when they are exploitable and can be replayed.

## Product

- [CYBRET](https://www.cybret.ai/): continuous autonomous security that gets teams back to building
- Black: map and test the public attack surface with no internal access
- Grey: go deeper behind login with an authorized identity
- White: connect source context so agents can trace authorization and data flows with evidence
- [Book a demo](https://calendly.com/adrian-cybret/30min)
- [Sign in](https://app.cybret.ai/)
- [Trust Center](https://trust.cybret.ai/)

## Research

- [Research index](https://www.cybret.ai/research)
- [The Agent Found the API Key. It Did Not Ask Whether It Could Use It.](https://www.cybret.ai/research/the-agent-found-the-api-key)
- [They Checked the Signature. They Did Not Check What the Token Could Do.](https://www.cybret.ai/research/they-checked-the-signature)
- [They Closed the Loop on Your Detections](https://www.cybret.ai/research/they-closed-the-loop-on-your-detections)
- [Why API Scanners Miss BOLA and IDOR](https://www.cybret.ai/research/why-api-scanners-miss-bola-and-idor)
- [Models Crossed the Cyber Threshold. Your APIs Did Not.](https://www.cybret.ai/research/models-crossed-the-cyber-threshold)
- [The Authorizer and the Handler Disagreed About Which Object This Was](https://www.cybret.ai/research/authorizer-and-handler-disagreed)
- [Your Single Use Coupon Is a Race, Not a Rule](https://www.cybret.ai/research/your-single-use-coupon-is-a-race)
- [Every Tool Call Was Allowed. The Sequence Was the Attack.](https://www.cybret.ai/research/every-tool-call-was-allowed)
- [AI Just Found the Vulnerability Static Analysis Was Never Designed to See](https://www.cybret.ai/research/ai-vulnerability-static-analysis)

## Careers

- [Careers at CYBRET](https://www.cybret.ai/careers)

## Documentation

- [MCP server](https://www.cybret.ai/docs/mcp): hosted, pull-only MCP server for reading and triaging findings Cybret has already proven

## Support

- [Support](https://www.cybret.ai/support)

## Optional

- [Full text](https://www.cybret.ai/llms-full.txt): longer product summary and research abstracts