The node (in the customer VPC)
A least-privilege executor that runs the tools. It runs no inference and holds no IP, and its only network path is to the membrane—so it has nothing worth stealing and no way to hand out what it briefly touches.
The only penetration test that runs inside your walls—and proves it never took anything.
Preditor runs an AI-native pentest as a governed cargo inside the customer's own environment. The inference stays with the operator, the loot stays in the customer's VPC, and only a content-blind findings scorecard crosses the boundary. It answers the single question that blocks most regulated red-team engagements: can I let a third party test my systems without them walking out with my crown jewels?
01 / The objection
A normal pentest walks out with the evidence.
To prove a finding, a tester takes it: the cracked password, the dumped database, the file they read. The proof is the stolen data—and it lands in the tester's hands and their cloud. For a bank, a hospital, or a defense program, that is often the scariest thing about hiring a red team, and the reason many high-value environments never get tested properly.
Positioning that survives a skepticPreditor proves the finding without keeping it. It still obtains the loot in-VPC—you cannot prove remote code execution without actually reading the file—but the loot is quarantined inside the customer's walls, and only a fingerprint plus a loot-free scorecard crosses back.
02 / How it works
The value inverts: the disposable part runs in the risky place.
Inference (operator-side)
The inference never leaves the operator. It runs against the content-blind scorecard, never against raw loot—so a stolen or prompt-injected session has no customer data to expose.
The membrane (the boundary)
Every command the node runs is co-signed and scope-limited (target, port, and tool). Every result is terminated at the membrane: the raw loot is quarantined in-VPC, keyed by a one-way digest, and only the scorecard is forwarded.
One-way egress
The node's network policy permits egress to the membrane only. Even if containment had a defect, the loot has no path out of the VPC—the only place its bytes can go is the membrane, which strips them.
03 / The content-blind scorecard
Structural facts cross. Secrets don't.
In-VPC extractors turn raw tool output into a closed, versioned findings scorecard. What crosses is the signal—the service version, the technique that worked, the CVE, the access level, the fact that credentials were obtained. What stays home is the content—the password value, the hash, the PII, the dumped rows, the sensitive path.
| Crosses the membrane (signal) | Stays in the customer VPC (loot) |
|---|---|
| Service + version, port, protocol | Raw banners, full tool output |
| CVE / technique / access level | Cracked passwords, captured hashes |
| "Credentials obtained" (type + status) | The credential values and usernames |
| Discovered-asset counts + digests | Literal paths, subdomains, dumped data, PII |
An auditor with in-VPC access re-hashes the retained loot and confirms it matches the digest that was reported—proof that the finding is real and that nothing beyond the fingerprint ever crossed the boundary.
04 / What's proven today
Containment is demonstrated in code and tests—not asserted.
Content-blindClosed egress schema; loot fields digested or dropped by construction
Per-toolLeak-safety tests on every supported tool, each planting a secret and proving it never crosses
Live-binaryFull governed handshake proven against the unmodified pentest node over a real socket
0Unsafe code; fail-closed on unknown egress kinds
- Every result is contained at a single chokepoint; the raw loot is quarantined in-VPC with recorded transform provenance (loot digest → scorecard digest).
- Commands are bounded by a co-signed treaty—target, port, and tool—so a hijacked inference cannot run an unsanctioned tool or reach an out-of-scope host.
- Adversarial review closed known exfiltration channels (a crafted result frame; free-text banner fields) and pinned each with a regression test.
- A whole-engagement system test drives a multi-tool kill chain and asserts, across every step, that no planted secret crosses while the structural signal does.
05 / Honest boundaries
Say exactly what the tier can prove.
| Claim | Honest positioning |
|---|---|
| Loot containment | Demonstrated by construction and per-tool tests; independent validation of the containment boundary is the next step, not a default |
| Deployment tier | Regulated / commercial-tier cargo. The pentest toolchain requires raw sockets, so the node is not a from-scratch sovereign-hardened workload—position it as governed and contained, not sovereign |
| Compromised node | Containment holds against the loot a node legitimately collects; a fully compromised node retains a bounded, low-bandwidth residual channel through structural fields—minimized and documented, not claimed impossible |
| Inference effectiveness | A representative experiment shows the inference stays productive and on-strategy from the scorecard; a full raw-vs-scorecard validation on the production engine is the pre-GA gate |
06 / Deployment
A governed cargo inside the customer's environment.
- Runs as a hardened workload in the customer VPC: non-root, read-only root filesystem, seccomp, minimal capabilities.
- Network policy restricts egress to the membrane only; ingress is denied.
- Real per-engagement signing keys and a co-signed scope; dev fallbacks are compiled out of release builds.
- The engagement produces an offline-verifiable evidence receipt that binds the verdict, scope, and audit head.