# the agentic harness for security teams Meet ZERO — an autonomous cyber environment that brings models, agent swarms, and tools under your command to test, trace, and verify your systems. ZERO is now in beta. Access is authorized per organization — request access and we enable your seats once your team is approved. [Request access](/zero#request-access) · [Documentation](https://docs.blackbit.sh) ## Film Watch the [BlackBit Zero Trailer](https://youtu.be/4mJTSMN0t5E) — the harness in motion, from a single command to swarm, forensic trace, and a fix you can retest. ## Product screens - **Command:** Start with a question — choose an asset, set your options, then task the harness in plain language. - **Discover:** See the real world first — build the attack-surface map before any agent runs. - **Attack:** A swarm, not one agent — hunter waves run in parallel and synthesize findings as they land. - **Fix:** Fixes, verified by a second swarm — a parallel deep-scan re-checks the work before it counts as done. - **Forensics:** Replay the whole engagement — every session, agent, and tool call on one signal map. - **Artifacts:** Reports you can retest — kill chain, remediation, and the exact retest criterion. ## Team experience Built by engineers previously at Lockheed Martin, Palantir, and Crypto.com. ## Harness capabilities - **Scoped autonomy:** Define authorized domains, repositories, clearance IDs, and operational limits before any agent runs. Pause, redirect, or abort in real time. - **Multi-agent swarms:** Orchestrate concurrent reconnaissance, analysis, and exploitation sub-agents across complex attack surfaces from a single operator command. - **Forensic trace map:** Inspect every model call, tool execution, and discovered weakness on a live signal graph with full evidence from initial recon to verification. - **Continuous retesting:** Turn point-in-time assessments into repeatable verification. Automatically re-run targeted checks as your code and infrastructure change. ## How it works 1. **Scope (p.01):** Set authorized domains, repositories, clearance IDs, and operational guardrails before any assessment begins. 2. **Task (p.02):** Select your model route on the VOID gateway and assign specialized Recon, Scout, or Hunter agents to the objective. 3. **Execute (p.03):** Coordinate autonomous agent swarms that enumerate surfaces, test weaknesses, and log verifiable evidence in isolated sandboxes. 4. **Verify (p.04):** Inspect the forensic trace map, validate remediation patches, and re-run targeted checks as your systems evolve. ## Autonomous agent classes - **Recon (ag-01 · enumeration):** Fast attack-surface enumeration, asset discovery, and dependency mapping across authorized domains and repositories. - **Scout (ag-02 · analysis):** Targeted vulnerability analysis, code review, and configuration testing across web applications, APIs, identity, and cloud. - **Hunter (ag-03 · research):** Long-horizon multi-swarm orchestration for deep exploit chains, binary reverse engineering, and zero-day research. ## Engagement controls Intensity decides how far exploitation goes. Depth decides how thoroughly recon maps the estate. The default is Deep + Medium. ### Intensity - **Medium:** Follow the attack path to one agreed objective. Finishes when that objective is proven, or the authorized surface is exhausted. - **Max:** Work the whole authorized surface. Every declared objective is proven, or recorded as blocked with a reason. - **Ultra:** Keep going after the first proof. New findings raise the priority board, and independent paths are delivered across successive rounds. ### Depth - **Shallow:** A lighter pass — 15 pages, one crawl level, a small wordlist. - **Deep:** The default. 30 pages, two crawl levels, larger wordlists, and parallel recon analysts. - **Zero-day:** Deep recon plus coverage-guided fuzzing, with an 8-hour research budget. This setting does not guarantee a new vulnerability. ## Capabilities and tools Start from a live system, source code, both, or an Android artifact. Engagements run across web, source, web3, wireless, cameras, and industrial networks. - **Web applications & APIs:** Map the exposed surface, then test inputs, access control, and business workflows. - **Source & delivery:** Review a repository — secrets, dependencies, containers, serverless functions, and cloud job identity. - **Identity & cloud:** Follow how one account becomes broader access across Active Directory, sessions, and supported cloud paths. - **Android applications:** Inspect APKs, then test in the managed emulator. Not iOS or physical devices. - **Blockchain & smart contracts:** Map contracts and replay supported Ethereum cases. Analyzer output is a lead, not proof. Wallets do not broadcast transactions. - **Fuzz & binaries:** Feed unexpected inputs and keep the evidence needed to reproduce a crash. - **Industrial & cameras:** Read-oriented discovery of supported industrial networks, plus ONVIF and RTSP cameras. No process writes. - **Assisted workflows:** Prepare tests for AI applications, wireless reconnaissance, privileged access, backups, printers, and signing. Execution still needs the operator. 188 registered blackbit tools: ### planning & methodology (29) - `blackbit_artifact` - `blackbit_clone_source` - `blackbit_closeout` - `blackbit_attack_plan` - `blackbit_plan_sync` - `blackbit_intel` - `blackbit_gate` - `blackbit_loot` - `blackbit_replay` - `blackbit_session_git` - `blackbit_index` - `blackbit_finalize` - `blackbit_report` - `blackbit_reduce` - `blackbit_patch_deliverable` - `blackbit_tool_families` - `blackbit_programs` - `blackbit_research` - `blackbit_recon_plan` - `blackbit_ensure_tools` - `blackbit_scope_check` - `blackbit_agent_budget` - `blackbit_coverage_note` - `blackbit_finding` - `blackbit_web_model` - `blackbit_web_scenario` - `blackbit_methodology_status` - `blackbit_detection_run` - `blackbit_emulate_actor` ### recon & discovery (27) - `blackbit_live_recon` - `blackbit_http` - `blackbit_http_triage` - `blackbit_port_scan` - `blackbit_content_disc` - `blackbit_archive_urls` - `blackbit_fingerprint` - `blackbit_osint` - `blackbit_shodan` - `blackbit_recon_dns` - `blackbit_schema` - `blackbit_cdn_map` - `blackbit_waf_probe` - `blackbit_rate_probe` - `blackbit_auth_map` - `blackbit_shadow_it` - `blackbit_recon_mobile` - `blackbit_mobile_device` - `blackbit_mobile_control` - `blackbit_mobile_traffic` - `blackbit_recon_delta` - `blackbit_recon_registry` - `blackbit_recon_serverless` - `blackbit_ot` - `blackbit_camera` - `blackbit_nuclei` - `blackbit_git_history` ### web vulnerabilities (22) - `blackbit_vuln_sqli` - `blackbit_vuln_xss` - `blackbit_vuln_ssrf` - `blackbit_vuln_idor` - `blackbit_vuln_xxe` - `blackbit_vuln_cors` - `blackbit_vuln_mass_assignment` - `blackbit_vuln_api_abuse` - `blackbit_vuln_websocket` - `blackbit_vuln_graph_inject` - `blackbit_vuln_nosql` - `blackbit_vuln_csrf_analyze` - `blackbit_vuln_hpp` - `blackbit_vuln_ssti` - `blackbit_vuln_deser` - `blackbit_vuln_csv` - `blackbit_vuln_race` - `blackbit_vuln_stateful_fuzz` - `blackbit_vuln_synthesize` - `blackbit_oob` - `blackbit_llm_sec` - `blackbit_vuln_serverless_inject` ### exploit (16) - `blackbit_exploit_chain` - `blackbit_exploit_jwt` - `blackbit_exploit_ssti` - `blackbit_exploit_generate` - `blackbit_exploit_upload` - `blackbit_exploit_auth_bypass` - `blackbit_exploit_pp` - `blackbit_exploit_dom_xss` - `blackbit_exploit_crlf` - `blackbit_exploit_xpath` - `blackbit_exploit_ldap` - `blackbit_exploit_mail_inject` - `blackbit_hackbrowser` - `blackbit_attack_script` - `blackbit_ebpf` - `blackbit_rf` ### identity & active directory (21) - `blackbit_lateral_pth` - `blackbit_lateral_tickets` - `blackbit_persist_schtask` - `blackbit_persist_registry` - `blackbit_persist_dll_hijack` - `blackbit_persist_service` - `blackbit_persist_linux` - `blackbit_persist_k8s` - `blackbit_ad_gpo` - `blackbit_ad_laps` - `blackbit_ad_delegation_unconstrained` - `blackbit_ad_sidhistory` - `blackbit_ad_bronzebit` - `blackbit_ad_spray` - `blackbit_identity` - `blackbit_network` - `blackbit_bloodhound` - `blackbit_adcs` - `blackbit_kerberos` - `blackbit_relay` - `blackbit_delegation` ### cloud & post-exploitation (22) - `blackbit_cloud_metadata` - `blackbit_cloud_aws_pe` - `blackbit_cloud_azure_ad` - `blackbit_cloud_k8s_pe` - `blackbit_cloud_escape` - `blackbit_cloud_storage_enum` - `blackbit_cloud_secrets_scan` - `blackbit_cloud_gcp_iam` - `blackbit_cloud_trigger_abuse` - `blackbit_supplychain` - `blackbit_tradecraft` - `blackbit_exfil_proof` - `blackbit_bolt` - `blackbit_cipipe` - `blackbit_pam` - `blackbit_wif` - `blackbit_backup` - `blackbit_printer` - `blackbit_collab_hunt` - `blackbit_supplychain_sign` - `blackbit_workflow_abuse` - `blackbit_c2` ### web3 (29) - `blackbit_web3_recon` - `blackbit_web3_detect` - `blackbit_web3_wallet` - `blackbit_web3_slither` - `blackbit_web3_halmos` - `blackbit_web3_foundry` - `blackbit_web3_defi` - `blackbit_web3_bridge` - `blackbit_web3_mempool` - `blackbit_web3_mev` - `blackbit_web3_nft` - `blackbit_web3_solana` - `blackbit_web3_anvil` - `blackbit_web3_aderyn` - `blackbit_web3_source_tree` - `blackbit_web3_decompile` - `blackbit_web3_move` - `blackbit_web3_cosmos` - `blackbit_web3_deps` - `blackbit_web3_vyper` - `blackbit_web3_aa` - `blackbit_web3_intent` - `blackbit_web3_svm_scan` - `blackbit_web3_rollup` - `blackbit_web3_callgraph` - `blackbit_web3_tx_trace` - `blackbit_web3_diff` - `blackbit_web3_svm_harness` - `blackbit_web3_economic_sim` ### fuzz & crash (2) - `blackbit_fuzz` - `blackbit_crash` ### defense evasion (15) - `blackbit_evasion_amsi` - `blackbit_evasion_etw` - `blackbit_evasion_memory` - `blackbit_evasion_hollow` - `blackbit_evasion_doppelganger` - `blackbit_evasion_macro_obfuscate` - `blackbit_evasion_ps_obfuscate` - `blackbit_evasion_shellcode_encode` - `blackbit_evasion_antidebug` - `blackbit_evasion_vm_detect` - `blackbit_evasion_timing` - `blackbit_evasion_activity` - `blackbit_evasion_lolbin` - `blackbit_evasion_signed_proxy` - `blackbit_evasion_c2_select` ### hooks (5) - `blackbit_aws_hook` - `blackbit_azure_hook` - `blackbit_kube_hook` - `blackbit_win_hook` - `blackbit_mac_hook` ## Use cases - **Continuous pen testing:** Run daily scoped assessments across evolving web applications, APIs, and cloud infrastructure without waiting for annual audit cycles. - **Application & smart contract audit:** Review pull requests, protocol upgrades, and critical code paths before deployment with coordinated specialist sub-agents. - **Zero-day & binary research:** Decompile, reverse engineer, and fuzz complex targets in isolated cloud sandboxes with long-running multi-agent swarms. - **Remediation verification:** Automatically re-run exploit traces against patched builds to verify that reported vulnerabilities are closed before release. ## Pricing ZERO is now in beta. Access is authorized per organization — request access and we enable your seats once your team is approved. - **Team — $399 per seat / month:** For security teams running scoped, continuous testing with the full harness — every agent class, multi-agent swarms, the forensic trace map, and continuous retesting. Access via request access; billing is per seat. - **Enterprise — custom:** For larger organizations with custom authorization, deployment, and support requirements — scope and terms are agreed before access is enabled. Access by request; billing is custom. ## Request access Access is authorized by email. Send us an email at [hello@blackbit.sh](mailto:hello@blackbit.sh?subject=ZERO%20beta%20%E2%80%94%20access%20request) and share: 1. **Your company:** The company you are from — your name, your role, and a work email we can verify. 2. **Test target:** The company you want to run tests for — and confirm you own those systems or have written authorization to test them. ZERO runs autonomous offensive agents. We authorize every organization before enabling access, so the platform cannot be used to hurt others. [Request access](/zero#request-access) --- path: /zero media-type: text/markdown; charset=utf-8 mirror: /api/view-as-md/zero