Risky is a guess. Exploitable is proof.
A scan tells you a port is open or a certificate is weak. It does not tell you whether an attacker could actually get in through it. With module hex, we will close that gap. Starting from what we already found with module scry, we will safely try the attacks a real intruder would, inside guardrails that stop short of an outage or lost data, and hand back proof of the exact path that worked plus the fix that closes it. Module hex is not available yet: this page describes what we are building.
automated penetration testing
soonProof it holds, not a checklist that says so.
We are building module hex to safely run the attacks that matter against your live surface, the moves a real intruder would try, and hand you proof of what got through, so you can close the hole before someone else finds it.
Module hex is still in development and not available yet. The rest of the platform, module scry, module ward and module sigil, is live today.
How module hex will work
- 01
Start from what we already found
We will start from the exposures we already mapped with module scry: open services, weak configurations, exposed credentials. Nothing gets probed that we have not already identified and scoped, and there is no separate discovery pass to run.
- 02
Attempt the real attack, safely
For each finding, we will attempt the same move an intruder would: try the leaked credential, chain the misconfiguration, follow the exposed path one step further. Every attempt will run inside guardrails designed to stop short of an outage or touching real data, so the test itself never becomes the incident.
- 03
Hand back proof and a fix, not a score
Where an attempt succeeds, you will get the exact chain of steps that worked and the specific fix for it, ready to open as a ticket in module ward. Where it does not, you will know that too, instead of guessing.
Where it fits
- scrysee what you are exposing
- hexyou are hereprove it can’t be broken into
- wardfix it, and confirm it’s gone
- sigilturn it into compliance evidence
Common questions about module hex
Is module hex available now?
No. Module hex is still in development. Today we map your exposure with module scry, track fixes to closure with module ward, and produce the NIS2 report with module sigil. Module hex is the piece we are building to sit between mapping the surface and fixing it, adding proof to the priority list. We will say so here when it is ready to switch on.
Will module hex attack our production systems without warning?
No. It will be something you switch on deliberately, for the assets you choose, never a background default. Every attempt will run inside guardrails built to stop short of anything that could cause an outage or touch real data: safe checks that prove a path is reachable without pushing the attack through to actual damage.
How will module hex be different from module scry?
With module scry, we map what is reachable and flag what looks risky. With module hex, we will go one step further: try the finding for real, using the same steps an intruder would, and hand you proof of what happened. If nothing gets through, you get a documented negative instead of a guess.
The NIS2 deadline isn't moving. Your setup can start today.
See what your company exposes to the internet, free and EU-hosted, with no security team required.
*Passive scan only. We never touch your systems. Free, no credit card, EU-hosted.