AEGNYX maps your attack surface, prices by the assets you actually run, and delivers evidence-grounded findings in six formats — in hours, not weeks. Every engagement is ownership-verified and authorized before a single test runs. Sovereign and offline-first, powered by the HOSH engine.
Every engagement is gated: the AEGNYX engine checks the immutable authorization record before it acts, and again on every step. No valid, in-scope, in-window, paid authorization → no test.
Add a domain, then prove control via DNS or verified-email challenge. You can only authorize testing of assets you actually own — the control that keeps self-service safe.
We enumerate what lives under your verified domains — subdomains, hosts, web apps, APIs, services — and you confirm the scope. That confirmed inventory is what we price and test.
Cost is calculated from your real assets, their complexity, and the test depth — shown line-by-line before you pay. The quoted total is the upfront price. No surprises.
You sign; iQs counter-signs under policy. The signed authorization, its hash, and the scope are sealed to a write-once (WORM) store before anything runs.
Safe recon and scanning run automatically; disruptive actions stay human-gated. Everything is checked against the sealed scope on every step, with an out-of-scope kill-switch.
Findings cite real records and proof, delivered in your Portal in six formats, each stamped with the engagement reference and hashes that trace back to the immutable record.
Pricing is computed from the assets we discover and you confirm: counts by type, complexity weighting, and your chosen depth tier. Transparent, upfront, non-refundable once testing begins.
Hosts, web apps, APIs and services are counted and weighted individually — a large application costs more than a static host.
Recon-only, Standard, or Deep. You choose how far testing goes within your authorized scope; the tier multiplies the per-asset rate.
Run a single engagement, or subscribe to continuous testing that re-verifies and re-authorizes each cycle.
Every format is generated from the same sealed findings dataset, so they can't disagree — and each is reference-stamped and hash-traceable to the immutable record.
You can only authorize assets you proved you control.
Dual-signed authorization sealed, timestamped, tamper-evident.
Runs owned and air-gapped; your data stays yours.
High-risk actions require a human; everything is audited.
