Saluki
01The continuous offensive security platform

See first.Move first.

Saluki runs automated red team operations against your live estate, continuously. Every verified path is routed to its owner, fixed and retested, with a Saluki operator behind each critical finding.

Book a demoSee the platform
  • Automated red team operations
  • Operator-reviewed evidence
  • Routed, fixed, retested
  • Nothing to install
  1. 01SightMaps your live estate from the outside in, and keeps the map current.
  2. 02SignalScores every exposure by heat, from live threat intelligence.
  3. 03PursuitRuns automated red team operations and proves each path.
  4. 04ResolveRoutes findings to owners, retests on close, reports to the board.
02The difference

A scanner tells you 4,000 things are vulnerable. Saluki shows you the seven paths that reach what you would lose.

Scanners list what is possible. Saluki pursues the objectives an adversary would, across identity, cloud and web, and proves which paths reach them. The rest stays on the list, watched, until it matters.

How Pursuit chooses a path
What a scanner sends you4,000 findings
  1. SC-3140InfoTLS 1.0 still enabled
  2. SC-3147LowDirectory listing enabled
  3. SC-3154LowCacheable HTTPS response
  4. SC-3161MediumSession cookie without HttpOnly
  5. SC-3168InfoDeprecated TLS renegotiation
  6. SC-3175LowMissing HSTS header
  7. SC-3182InfoWeak cipher suite offered
  8. SC-3189LowMissing Content-Security-Policy
  9. SC-3196LowEmail spoofing: SPF soft fail
  10. SC-3203MediumX-Content-Type-Options missing
  11. SC-3210InfoCookie set without the Secure flag
  12. SC-3217LowAutocomplete on a password field
  13. SC-3224InfoCertificate expires in 30 days
  14. SC-3231LowDMARC policy set to none
  15. SC-3238LowMixed content on landing page
  16. SC-3245MediumServer banner discloses version
  17. SC-3252InfoClickjacking header missing
  18. SC-3259LowOPTIONS method allowed
  19. SC-3266InfoOpen port 8443 on edge node
  20. SC-3273LowTrace method enabled
  21. SC-3280LowOutdated JavaScript library
  22. SC-3287MediumVerbose error page
  23. SC-3294InfoReferrer policy not set
  24. SC-3301LowSelf-signed certificate on test host
  25. SC-3308InfoMissing Content-Security-Policy
  26. SC-3315LowEmail spoofing: SPF soft fail
  27. SC-3322LowX-Content-Type-Options missing
  28. SC-3329MediumCookie set without the Secure flag
  29. SC-3336InfoAutocomplete on a password field
  30. SC-3343LowCertificate expires in 30 days
  31. SC-3350InfoDMARC policy set to none
  32. SC-3357LowMixed content on landing page
  33. SC-3364LowServer banner discloses version
  34. SC-3371MediumClickjacking header missing
  35. SC-3378InfoOPTIONS method allowed
  36. SC-3385LowOpen port 8443 on edge node
  37. SC-3392InfoTrace method enabled
  38. SC-3399LowOutdated JavaScript library
  39. SC-3406LowVerbose error page
  40. SC-3413MediumReferrer policy not set
  41. SC-3420InfoSelf-signed certificate on test host
  42. SC-3427LowTLS 1.0 still enabled
  43. SC-3434InfoDirectory listing enabled
  44. SC-3441LowCacheable HTTPS response
  45. SC-3448LowSession cookie without HttpOnly
  46. SC-3455MediumDeprecated TLS renegotiation
  47. SC-3462InfoMissing HSTS header
  48. SC-3469LowWeak cipher suite offered
and 3,952 morepage 1 of 160
What Saluki sends you07 paths
  1. 01Open the VPN administration consoleInternetStandard VPN accountAdmin consolevpn-02.brackwell.example91Verified
  2. 02Read tenant data with an expired tokenInternetLegacy APITenant recordsapi-legacy.brackwell.example86Testing
  3. 03List a storage bucket from the internetInternetPublic bucketCustomer exportsassets-eu.brackwell-cloud.example82Retest
  4. 04Map internal hosts from SSO metadataInternetSSO metadataInternal hostnamessso.brackwell.example78Testing
  5. 05Send mail as Brackwell through the relayInternetOpen relayStaff inboxesmx-02.brackwell.example74Verified
  6. 06Read production metrics without signing inInternetDashboardProduction telemetrygrafana.ops.brackwell.example71Retest
  7. 07Reach the corporate gateway from Harbour FleetAcquired brandShared identityGateway consolegateway-01.brackwell.example70Watching
03Automated red team operations

One operation, end to end.

Objective set.Path proven.Loop closed.

  1. 01Objective

    Set the objective an adversary would.

    Reach the admin console. Read another tenant's data. Cross from a supplier into the corporate estate. Saluki pursues it across identity, cloud and web, inside the rules you set.

    Recon · Access · Escalate · Objective

  2. 02Proof

    Prove the path, with evidence.

    Each step is reproduced and the request and response are captured. A Saluki operator checks every critical finding before it is raised.

    Reproduced 3 of 3 · No data changed

  3. 03Closure

    Route it. Fix it. Retest it.

    The finding becomes a Jira ticket with owner, heat and evidence. The team hears in Slack. Closing the ticket triggers the retest, and the board page records the result.

    PLT-412 · Verified fixed in 1 d 23 h

The full method
04Intelligence-led targeting
Live

Every exposure
has a temperature.

Heat is how Saluki decides where to go first. Saluki Labs tracks the actors and techniques aimed at your sector. Signal scores every exposure by likelihood, reachability and impact, and recomputes as the threat picture and your surface change. You get a short list, and the reason for every line.

Why PR-0917 is 91vpn-02.brackwell.example91Critical
  • Likelihood94Admin consoles on VPN appliances are an active technique in your sector this quarter.
  • Reachability88Internet-facing, and a standard account reaches it without a second check.
  • Impact92The console reads tenant configuration for the whole corporate estate.
Thermal scanLive

Exposures 148 · Hot 07 · Retesting 03 · Sweep 00:42

  • Hot

    Act now. A real adversary could use this today.

  • Warm

    Plan it. Reachable, but not yet proven or not yet cheap to exploit.

  • Cool

    We are watching. Known, monitored, and will warm the moment it matters.

How Signal scores heat
05Remediation

From finding to closure.

A verified finding becomes a ticket with its owner, heat and evidence attached. The team hears where it already talks. Closing the ticket triggers a retest, and the board page shows hot to fixed every month, on one page.

Mean time to fix

3.2 d0.4 d this month

Time to fix
1 d 1 hPLT-412 · raised to deployed
Verified fixed
1 d 23 hraised to verified fixed
This month
Hot 7 to 2October 2026
PR-0917Admin panel reachable from the internet
  1. VerifiedSaluki24 Oct · 22:28Reproduced 3 of 3 and checked by operator AK.
  2. RoutedJira24 Oct · 22:28PLT-412 raised for the Platform team with heat, owner and evidence.
  3. NotifiedSlack24 Oct · 22:28Posted to #sec-platform with the evidence a click away.
  4. AcknowledgedPlatform team25 Oct · 09:12Fix scheduled for the maintenance window.
  5. Fix deployedGitHub Actions25 Oct · 23:40Deploy pipeline closed the ticket and asked for a retest.
  6. RetestSaluki26 Oct · 22:03Pursuit replayed the path from a clean session.
  7. Verified fixedJira26 Oct · 22:09The console now refuses the user role. PLT-412 closed.
  8. Board pageReportsOctober 2026Hot 7 to 2 this month, on one page.
How Resolve closes the loop
06Integrations

Findings go where your team already works.

Jira, ServiceNow, Slack, Microsoft Teams, Splunk, Sentinel, Okta, GitHub Actions, PagerDuty: by name, with an API and webhooks behind all of it. Routing rules decide who hears, where, and what happens when the ticket closes.

Verified findings travel out to your tools. A closed ticket travels back as a retest.

Routing rule

Routing rules

RR-07Active
Hot payments findings
When
finding.verified
If
heat ≥ 80andowner is Payments
Then
  • 01Create a ticketJira
  • 02Notify #sec-paymentsSlack
  • 03Retest on closeSaluki
Last fired 14 min ago · PR-0911 → PAY-208

Webhook events

  • surface.changed
  • operation.started
  • finding.verified
  • finding.routed
  • finding.fixed
  • retest.passed
07Safe by design

Built to run against production.

Security & trust

  1. Scoped by you

    You set the targets, the windows and the pace. The platform enforces them; nobody has to remember.

    • Scope3 domains, 2 ranges
    • Window22:00-06:00 UTC
    • PaceLow

  2. Non-destructive by default

    Tests read, compare and reproduce. They never change a record, and they never run a payload that could.

    No data changed

  3. Fully auditable

    Every action is logged with its evidence, so you can show exactly what was tested, when and how.

    14:02:11 · pursuit · GET /admin · vpn-02 · 200 · evidence saved

  4. Enterprise access

    Single sign-on, role-based access, API access and regional hosting options.

    • SSO
    • RBAC
    • API
    • Regional hosting
08Operators

Platform-first.
Operator-backed.

Autonomy gives you coverage. Operators give you certainty. Every critical finding is reviewed by a Saluki operator before it reaches you. When you need a full red team, an emulation campaign or a board briefing, the same team delivers it inside the platform.

Real-world attacks.Real insight.

The same operators who review your findings run the engagements. Nothing gets lost between a platform and a provider.

Meet the operators
Saluki Labs

Research that moves first.

Original research, tooling and field notes from the people who build the platform and run the operations.

All research
09

See it run against your estate.

Book a demo and we will map your surface live, then show you the first path that matters. Or start with a domain.

Book a demo