Adversarial Exposure Validation, self-hosted

Prove which exposures are actually exploitable.

Cyberblade Assay validates exposures in your own environment under a signed, in-scope authorization, ranks remediation by proven reachability instead of raw CVSS, and re-runs a finding to confirm a fix actually closed the path.

Authorization, safe-mode enforcement, the audit log, and the kill switch ship in the free core — never paywalled.

The Community core is fully open source (Apache-2.0). Browse, self-audit, or contribute: gitlab.com/cyberbladesec/assay-ce

The engine

How it works

Proof, not a guess

A validation produces a signed evidence bundle or it produces nothing. Findings are ranked by a proven path to a crown jewel, not a CVSS score no one has tested against your environment.

Safe by default

Passive and active-safe techniques run by default. Active-safe proves a condition with evidence — a planted canary, an out-of-band beacon callback — never a shell, a write, or persistence. Active-intrusive techniques require a two-person-gated, separately licensed capability and are absent from the default build.

Authorization is enforced, not just requested

No technique runs against any target without a valid, signed, in-scope engagement authorization, checked at a single choke-point in the engine. No authorization on file means a refusal, and the refusal is recorded in a hash-chained audit log.

Self-hosted, always

Assay runs on your own infrastructure. It makes no runtime call to any Cyberblade-operated endpoint and sends no customer data anywhere Cyberblade operates. The guardrails — authorization, safe-mode enforcement, the audit log, the kill switch — ship in the free, open-core edition and are never paywalled.

Built-in guarantees

Guardrails are free-core, never add-ons

The controls that keep every technique in scope and every result provable are in the free core and fail closed. Paid tiers add scale and reporting — they never change what protects you.

Authorization choke-point

A single, default-deny gate: no technique touches a target without a signed, in-scope engagement grant. Absence of authorization is a refusal, always audited.

Safe-mode classification

Every technique is classed passive, active-safe, or active-intrusive. Only passive and active-safe run by default — proof by evidence, never effect.

Hash-chained audit

Every privileged action and every refusal lands in a tamper-evident, hash-chained log, in every tier.

Blast-radius governance

Concurrency and rate caps, an allowed-window scheduler, a target-health circuit breaker, and a global kill switch — all free-core, none bypassable.

Signed provenance

A validation produces a signed evidence bundle or it produces nothing. Proof is verifiable, not asserted.

Fail-closed by default

Missing secrets or security config stop the engine rather than degrade it. Secrets come from OpenBao; the platform fails closed when they are absent.

Editions

Pricing

Community and Enterprise are the same build — there is no separate download. Enterprise features stay compiled out until you install an offline, Ed25519-signed license, verified locally with no online activation.

Community

Free & open source

The free core — every guardrail, never paywalled

Freeforever

Every guardrail: authorization, safe-mode, audit, kill switch
The full active-safe technique library
Reachability graph & proven-path prioritization
Fix verification — re-run a finding to confirm the path is closed
HTML / PDF / CSV / JSON reports, CLI & SDK

Read the deployment guide

Enterprise

Scale, compliance, and multi-tenant orchestration

Everything in Community
Compliance-framework reporting packs
Multi-tenant orchestration with SSO & SCIM
Benchmarked-scale concurrency & high availability
Managed graph analytics & usage metering

Docs

Get started

Deploy Assay on your own infrastructure with Docker or Podman Compose, or Kubernetes and Helm for high availability.

Read the deployment guide