# the agentic swarms for security teams

Meet ZERO — an autonomous cyber environment that brings models, agent swarms, and tools under your command to test, trace, and verify your systems.

ZERO is now in beta. Access is authorized per organization — request enterprise access and we enable your seats once your team is approved.

[Request enterprise access](/#request-access) · [Documentation](https://docs.blackbit.sh)

## Film

Watch the [BlackBit Zero Trailer](https://youtu.be/4mJTSMN0t5E) — swarms in motion, from a single command to forensic trace, and a fix you can retest.

## Product screens

- **Command:** Start with a question — choose an asset, set your options, then task the swarms in plain language.
- **Discover:** See the real world first — build the attack-surface map before any agent runs.
- **Attack:** A swarm, not one agent — hunter waves run in parallel and synthesize findings as they land.
- **Fix:** Fixes, verified by a second swarm — a parallel deep-scan re-checks the work before it counts as done.
- **Forensics:** Replay the whole engagement — every session, agent, and tool call on one signal map.
- **Artifacts:** Reports you can retest — kill chain, remediation, and the exact retest criterion.

## Team experience

Built by engineers previously at Lockheed Martin, Palantir, and Crypto.com.

## Swarm capabilities

- **Scoped autonomy:** Define authorized domains, repositories, clearance IDs, and operational limits before any agent runs. Pause, redirect, or abort in real time.
- **Multi-agent swarms:** Orchestrate concurrent reconnaissance, analysis, and exploitation sub-agents across complex attack surfaces from a single operator command.
- **Forensic trace map:** Inspect every model call, tool execution, and discovered weakness on a live signal graph with full evidence from initial recon to verification.
- **Agentic fix mode:** Find vulnerabilities from the outside in black-box mode, then switch to fix mode when you have code access so agents patch and retest.

## How it works

1. **Scope (p.01):** Set authorized domains, repositories, clearance IDs, and operational guardrails before any assessment begins.
2. **Task (p.02):** Select your model route on the VOID gateway and assign specialized Recon, Scout, or Hunter agents to the objective.
3. **Execute (p.03):** Coordinate autonomous agent swarms to enumerate surfaces, test weaknesses from the outside in black-box mode, and log verifiable evidence.
4. **Fix & verify (p.04):** Switch to fix mode when code access is available so agents remediate discovered vulnerabilities, then re-run traces to verify the patch.

## Autonomous agent classes

- **Recon (ag-01 · enumeration):** Fast attack-surface enumeration, asset discovery, and dependency mapping across authorized domains and repositories.
- **Scout (ag-02 · analysis):** Targeted vulnerability analysis, code review, and configuration testing across web applications, APIs, identity, and cloud.
- **Hunter (ag-03 · research):** Long-horizon multi-swarm orchestration for deep exploit chains, binary reverse engineering, and zero-day research.

## Engagement controls

Intensity decides how far exploitation goes. Depth decides how thoroughly recon maps the estate. The default is Deep + Medium.

### Intensity

- **Medium:** Follow the attack path to one agreed objective. Finishes when that objective is proven, or the authorized surface is exhausted.
- **Max:** Work the whole authorized surface. Every declared objective is proven, or recorded as blocked with a reason.
- **Ultra:** Keep going after the first proof. New findings raise the priority board, and independent paths are delivered across successive rounds.

### Depth

- **Shallow:** A lighter pass — 15 pages, one crawl level, a small wordlist.
- **Deep:** The default. 30 pages, two crawl levels, larger wordlists, and parallel recon analysts.
- **Zero-day:** Deep recon plus coverage-guided fuzzing, with an 8-hour research budget. This setting does not guarantee a new vulnerability.

## Capabilities and tools

Start from a live system, source code, both, or an Android artifact. Engagements run across web, source, web3, wireless, cameras, and industrial networks.

- **Web applications & APIs:** Map the exposed surface, then test inputs, access control, and business workflows.
- **Source & delivery:** Review a repository — secrets, dependencies, containers, serverless functions, and cloud job identity.
- **Identity & cloud:** Follow how one account becomes broader access across Active Directory, sessions, and supported cloud paths.
- **Android applications:** Inspect APKs, then test in the managed emulator. Not iOS or physical devices.
- **Blockchain & smart contracts:** Map contracts and replay supported Ethereum cases. Analyzer output is a lead, not proof. Wallets do not broadcast transactions.
- **Fuzz & binaries:** Feed unexpected inputs and keep the evidence needed to reproduce a crash.
- **Industrial & cameras:** Read-oriented discovery of supported industrial networks, plus ONVIF and RTSP cameras. No process writes.
- **Assisted workflows:** Prepare tests for AI applications, wireless reconnaissance, privileged access, backups, printers, and signing. Execution still needs the operator.

188 registered blackbit tools:

### planning & methodology (29)

- `blackbit_artifact`
- `blackbit_clone_source`
- `blackbit_closeout`
- `blackbit_attack_plan`
- `blackbit_plan_sync`
- `blackbit_intel`
- `blackbit_gate`
- `blackbit_loot`
- `blackbit_replay`
- `blackbit_session_git`
- `blackbit_index`
- `blackbit_finalize`
- `blackbit_report`
- `blackbit_reduce`
- `blackbit_patch_deliverable`
- `blackbit_tool_families`
- `blackbit_programs`
- `blackbit_research`
- `blackbit_recon_plan`
- `blackbit_ensure_tools`
- `blackbit_scope_check`
- `blackbit_agent_budget`
- `blackbit_coverage_note`
- `blackbit_finding`
- `blackbit_web_model`
- `blackbit_web_scenario`
- `blackbit_methodology_status`
- `blackbit_detection_run`
- `blackbit_emulate_actor`

### recon & discovery (27)

- `blackbit_live_recon`
- `blackbit_http`
- `blackbit_http_triage`
- `blackbit_port_scan`
- `blackbit_content_disc`
- `blackbit_archive_urls`
- `blackbit_fingerprint`
- `blackbit_osint`
- `blackbit_shodan`
- `blackbit_recon_dns`
- `blackbit_schema`
- `blackbit_cdn_map`
- `blackbit_waf_probe`
- `blackbit_rate_probe`
- `blackbit_auth_map`
- `blackbit_shadow_it`
- `blackbit_recon_mobile`
- `blackbit_mobile_device`
- `blackbit_mobile_control`
- `blackbit_mobile_traffic`
- `blackbit_recon_delta`
- `blackbit_recon_registry`
- `blackbit_recon_serverless`
- `blackbit_ot`
- `blackbit_camera`
- `blackbit_nuclei`
- `blackbit_git_history`

### web vulnerabilities (22)

- `blackbit_vuln_sqli`
- `blackbit_vuln_xss`
- `blackbit_vuln_ssrf`
- `blackbit_vuln_idor`
- `blackbit_vuln_xxe`
- `blackbit_vuln_cors`
- `blackbit_vuln_mass_assignment`
- `blackbit_vuln_api_abuse`
- `blackbit_vuln_websocket`
- `blackbit_vuln_graph_inject`
- `blackbit_vuln_nosql`
- `blackbit_vuln_csrf_analyze`
- `blackbit_vuln_hpp`
- `blackbit_vuln_ssti`
- `blackbit_vuln_deser`
- `blackbit_vuln_csv`
- `blackbit_vuln_race`
- `blackbit_vuln_stateful_fuzz`
- `blackbit_vuln_synthesize`
- `blackbit_oob`
- `blackbit_llm_sec`
- `blackbit_vuln_serverless_inject`

### exploit (16)

- `blackbit_exploit_chain`
- `blackbit_exploit_jwt`
- `blackbit_exploit_ssti`
- `blackbit_exploit_generate`
- `blackbit_exploit_upload`
- `blackbit_exploit_auth_bypass`
- `blackbit_exploit_pp`
- `blackbit_exploit_dom_xss`
- `blackbit_exploit_crlf`
- `blackbit_exploit_xpath`
- `blackbit_exploit_ldap`
- `blackbit_exploit_mail_inject`
- `blackbit_hackbrowser`
- `blackbit_attack_script`
- `blackbit_ebpf`
- `blackbit_rf`

### identity & active directory (21)

- `blackbit_lateral_pth`
- `blackbit_lateral_tickets`
- `blackbit_persist_schtask`
- `blackbit_persist_registry`
- `blackbit_persist_dll_hijack`
- `blackbit_persist_service`
- `blackbit_persist_linux`
- `blackbit_persist_k8s`
- `blackbit_ad_gpo`
- `blackbit_ad_laps`
- `blackbit_ad_delegation_unconstrained`
- `blackbit_ad_sidhistory`
- `blackbit_ad_bronzebit`
- `blackbit_ad_spray`
- `blackbit_identity`
- `blackbit_network`
- `blackbit_bloodhound`
- `blackbit_adcs`
- `blackbit_kerberos`
- `blackbit_relay`
- `blackbit_delegation`

### cloud & post-exploitation (22)

- `blackbit_cloud_metadata`
- `blackbit_cloud_aws_pe`
- `blackbit_cloud_azure_ad`
- `blackbit_cloud_k8s_pe`
- `blackbit_cloud_escape`
- `blackbit_cloud_storage_enum`
- `blackbit_cloud_secrets_scan`
- `blackbit_cloud_gcp_iam`
- `blackbit_cloud_trigger_abuse`
- `blackbit_supplychain`
- `blackbit_tradecraft`
- `blackbit_exfil_proof`
- `blackbit_bolt`
- `blackbit_cipipe`
- `blackbit_pam`
- `blackbit_wif`
- `blackbit_backup`
- `blackbit_printer`
- `blackbit_collab_hunt`
- `blackbit_supplychain_sign`
- `blackbit_workflow_abuse`
- `blackbit_c2`

### web3 (29)

- `blackbit_web3_recon`
- `blackbit_web3_detect`
- `blackbit_web3_wallet`
- `blackbit_web3_slither`
- `blackbit_web3_halmos`
- `blackbit_web3_foundry`
- `blackbit_web3_defi`
- `blackbit_web3_bridge`
- `blackbit_web3_mempool`
- `blackbit_web3_mev`
- `blackbit_web3_nft`
- `blackbit_web3_solana`
- `blackbit_web3_anvil`
- `blackbit_web3_aderyn`
- `blackbit_web3_source_tree`
- `blackbit_web3_decompile`
- `blackbit_web3_move`
- `blackbit_web3_cosmos`
- `blackbit_web3_deps`
- `blackbit_web3_vyper`
- `blackbit_web3_aa`
- `blackbit_web3_intent`
- `blackbit_web3_svm_scan`
- `blackbit_web3_rollup`
- `blackbit_web3_callgraph`
- `blackbit_web3_tx_trace`
- `blackbit_web3_diff`
- `blackbit_web3_svm_harness`
- `blackbit_web3_economic_sim`

### fuzz & crash (2)

- `blackbit_fuzz`
- `blackbit_crash`

### defense evasion (15)

- `blackbit_evasion_amsi`
- `blackbit_evasion_etw`
- `blackbit_evasion_memory`
- `blackbit_evasion_hollow`
- `blackbit_evasion_doppelganger`
- `blackbit_evasion_macro_obfuscate`
- `blackbit_evasion_ps_obfuscate`
- `blackbit_evasion_shellcode_encode`
- `blackbit_evasion_antidebug`
- `blackbit_evasion_vm_detect`
- `blackbit_evasion_timing`
- `blackbit_evasion_activity`
- `blackbit_evasion_lolbin`
- `blackbit_evasion_signed_proxy`
- `blackbit_evasion_c2_select`

### hooks (5)

- `blackbit_aws_hook`
- `blackbit_azure_hook`
- `blackbit_kube_hook`
- `blackbit_win_hook`
- `blackbit_mac_hook`

## Use cases

- **Continuous pen testing:** Run daily scoped assessments across evolving web applications, APIs, and cloud infrastructure without waiting for annual audit cycles.
- **Application & smart contract audit:** Review pull requests, protocol upgrades, and critical code paths before deployment with coordinated specialist sub-agents.
- **Zero-day & binary research:** Decompile, reverse engineer, and fuzz complex targets in isolated cloud sandboxes with long-running multi-agent swarms.
- **Remediation verification:** Automatically re-run exploit traces against patched builds to verify that reported vulnerabilities are closed before release.

## Pricing

Pro is self-serve with a cloud sandbox at $2,100 per month. Enterprise starts at $27,000 per month and includes every Pro feature, plus the desktop app, Android and iOS mobile app pentesting, fix mode, custom LLM providers, OT, custom support, and training. It scales with user count, domains, and scope.

| What's included | Pro ($2,100/month) | Enterprise (from $27,000/month) |
| --- | --- | --- |
| Web, API & cloud pentesting — run scoped agent swarms across authorized domains and endpoints | included | included |
| Web3 & smart contract testing — map smart contracts, analyze protocols, and replay on-chain exploit paths | included | included |
| Cloud sandbox execution — run swarms in isolated cloud sandboxes with no local setup | included | included |
| Bluetooth testing — discover and assess nearby Bluetooth devices and services | not included | included |
| Wi-Fi reconnaissance — map wireless networks, access points, and authentication setups | not included | included |
| iOS security testing — inspect iOS applications, traffic, and local storage | not included | included |
| Mobile spyware detection — check mobile devices and artifacts for indicators of compromise | not included | included |
| Desktop application — run ZERO locally from the native desktop client | not included | included |
| Mobile application pentesting (Android & iOS) — pentest Android and iOS mobile applications, APIs, and local storage | not included | included |
| Agentic fix mode — agents patch discovered issues in code and re-run verification | not included | included |
| Custom LLM inference providers — connect your own model endpoints and private inference gateways | not included | included |
| OT & industrial networks — read-oriented discovery across operational technology and cameras | not included | included |
| Dedicated engineering support — direct support from the BlackBit team during assessments | not included | included |
| Operator training — guided onboarding and workflow training for your security team | not included | included |
| Custom seats, domains & scope — capacity and authorization limits tailored to your organization | not included | included |

[Unlock access](https://zero.blackbit.sh) · [Request enterprise access](/#request-access)

## Request enterprise access

Access is authorized by email. Send us an email at [hello@blackbit.sh](mailto:hello@blackbit.sh?subject=ZERO%20enterprise%20access%20request) and share:

1. **Your company:** The company you are from — your name, your role, and a work email we can verify.
2. **Test target:** The company you want to run tests for — and confirm you own those systems or have written authorization to test them.

ZERO runs autonomous offensive agents. We authorize every organization before enabling access, so the platform cannot be used to hurt others.

[Request enterprise access](/#request-access)

---

path: /
media-type: text/markdown; charset=utf-8
mirror: /api/view-as-md