OSINT and exposed credentials
Public-source signals and credentials related to the scope help investigate potential entry points. Exploitation stays within authorized limits.
offensive division
Pentest AI · Adversary Engine
Ares Autonomous AI pentesting
Your digital surface, under adversarial investigation.
ARES investigates applications, APIs and mobile apps, correlates OSINT and exposed-credential signals, and tests how those exposures could connect into an attack. AI agents, technical evidence and human oversight from Vultus, within an authorized scope.
In the news
Offensive investigation at large enterprises.
Case studies published by Security Leaders show ARES in mobility, retail and healthcare operations. EXAME covers how Vultus is building its experience into proprietary technology.
offensive experience
Over 18 years of experience and Vultus Red Team TTPs built into the harness.
public case studies
Documented results from three scopes, with evidence to guide remediation.
human oversight
Specialists guide objectives, limits and deeper investigation.
Security Leaders · June 11, 2026
Public case study #1
Mobility: an off-peak testing window produced findings and evidence to guide remediation.
Read the article → Security Leaders · June 5, 2026Public case study #2
Retail: autonomous agents investigated a critical application, producing technical documentation the team could act on.
Read the article → Security Leaders · October 2, 2026Public case study #3
Healthcare: a critical scope was tested on a tight deadline, with two attack chains and information for reproduction and remediation.
Read the article → EXAME · August 31, 2026Vultus in EXAME
The article covers ARES and the R$8 million investment to accelerate the development of Vultus's proprietary technology.
Read the article →Landscape
A new integration can open another attack path.
Applications change, APIs gain permissions and credentials can surface outside the environment. A periodic assessment alone cannot account for everything that has changed since the last test. ARES adds investigation that is recurring, with a defined scope and retesting after fixes.
The problem
Automation and specialists in the same operation.
ARES complements periodic pentests. Agents extend the investigation; pentesters and red teamers guide the work and go deeper where context is needed.
Vultus specialists
Direction and depth
- Defining objectives, access and the authorized scope
- Execution limits agreed before testing
- Understanding context and business rules
- Evidence review and impact validation
- Deeper technical investigation where needed
- Prioritizing and guiding remediation
Autonomous investigation
ARES by Vultus
- Context gathering across the authorized surface
- Forming and testing adversarial hypotheses
- Controlled exploitation and vulnerability chaining
- Recording tested paths and evidence
- Validation between changes and pentest cycles
- Retesting to verify fixes
From an isolated exposure to an attack path.
About ARES
Pentest AI that investigates how an attack progresses.
ARES is a multi-agent adversarial architecture: AI agents gather context, form hypotheses and test attack paths. Vultus's proprietary harness coordinates their work, drawing on the experience, tactics, techniques and procedures of its Red Team.
The investigation connects discovery, exploitation and evidence. Specialists provide technical direction and help turn demonstrated impact into remediation priorities. Explore the foundations of Vultus's AI pentesting service.
what it is
Agents with offensive direction
An adversarial operation coordinated by proprietary technology, with an authorized scope, limits and expert review.
who it is for
Evolving digital surfaces
Companies with applications, APIs, mobile apps and integrations that need to validate changes, investigate exposures and retest fixes.
the problem it solves
From an alert to exploitable risk
Connects exposures to potential impact, with evidence to decide what to fix and where to investigate further.
Speedfrom hypothesis to validation with AI agents
Scaleinvestigation across multiple assets and integrations
Frequencychanges, retesting and validation cycles
Exploitable riskevidence-based prioritization
Coverage
Attack context goes beyond the application.
Targets, access and objectives are defined for each operation. The investigation can bring together different parts of the digital surface to test how they connect.
Applications, APIs and integrations
Authentication, permissions and business rules inform attack hypotheses. Testing investigates how one exposure could lead to others.
Virtualization and reverse engineering
Virtualized environments and language models support the extraction and analysis of app information. This context informs testing and evidence collection.
Lifecycle
Where ARES fits in the application lifecycle.
ARES can be used before a launch, after changes to applications, APIs or mobile apps, and for retesting after fixes. In production, recurring validation complements periodic pentests, with scope and limits defined for each operation.
Architecture
Build & AppSecvalidates whether an alert is exploitable
QA / Staging
Pre-deploymentsimulates a controlled attack before production
Go-live / Change
Productionrecurring validation between fixes
ARES Engine
An autonomous adversary with guardrails, an approved scope and human validation by Vultus.
How it fits the workflow
ReconHypothesesControlled testingValidated exploitationEvidence + QA
AppSec · Applications, APIs and mobile · Changes · Retesting · Governance
ARES Killchains Breakdown
From the first signal to an attack chain.
This Vultus series follows simulations run by ARES. Each episode explains the hypotheses, evidence and potential impact of an attack sequence.
EP. 0122:12
Watch on YouTube
EP. 0225:35
Watch on YouTube
EP. 0317:25
Watch on YouTube
EP. 0414:58
Watch on YouTube
From an exposed credential to the cloud
A credential becomes the starting point for investigating access to personal data and cloud infrastructure.
One request, one exploitation chain
Starting from a natural-language instruction, 7 hours and 30 minutes of autonomous execution produced a documented attack chain.
Vibe coding under investigation
ARES investigates an AI-assisted coding flaw and gathers evidence to guide remediation.
From a photo upload to the domain
A forgotten application and a profile upload start a simulation that escalates to domain administrator.
Videos are in Portuguese. These episodes show specific operations, not guaranteed timelines or results for other environments.
Console
Explore the operation view.
Explore an example target, objective, findings, evidence and agent activity. This demonstration uses simulated data and does not run tests against your environment.
Active operation
65%
2Critical
2High
2Medium
2Low
1Info
Critical
SQL injection in the transaction report
▸
Critical
Admin access is possible without a password
▸
High
Customer can view other customers' statements
▸
Medium
Malicious content stored in a profile
▸
Target map
app.acme-fintech.com
├ /login
├ /app/profile
├ /api/v2/reports
├ /api/admin
└ /api/integrations/webhook-test
├ /login
├ /app/profile
├ /api/v2/reports
├ /api/admin
└ /api/integrations/webhook-test
Agent activity
▸recon · mapping the target surface
▸analysis · inspecting authentication and sessions
▸SQL injection confirmed · CRITICAL
exploitation · validating the escalation chain
illustrative interface · demo environment · simulated data, masked payloads, no executable offensive content
Numbers
Results you can check at the source.
Security Leaders reports document the results of each operation, including context, duration and finding severity.
results reported for specific scopes
Public case study #1
26
vulnerabilities in 3 hours, including 6 critical findings.
Read the case report Public case study #2
89
vulnerabilities in 6 hours, including 21 critical and 29 high-severity findings.
Read the case report Public case study #3
38
vulnerabilities in 5 hours, including 8 critical findings. The operation also demonstrated two attack chains.
Read the case report Figures reported for separate tests and scopes. These are not product averages or performance guarantees. Operation duration should not be confused with time to the first finding.
Expertise
Over 18 years of Red Team experience, built into the ARES harness.
Vultus develops the technology in-house. The harness brings together offensive knowledge and Red Team TTPs to coordinate agents and investigate paths relevant to each environment. That experience also guides evidence review and decisions about where to investigate further.
pillar · 01
Brazilian technology and a proprietary harness
pillar · 02
Experience and TTPs from Vultus's Red Team
pillar · 03
Context and adversarial hypotheses
pillar · 04
Evidence to prioritize the response
pillar · 05
Guardrails, traceability and a clear scope
ISG Provider Lens · Brazil · 2025
Vultus recognized as a leader in Risk-based Vulnerability Management
Vultus's recognition in the Risk-based Vulnerability Management quadrant of the ISG Provider Lens Cybersecurity, Services and Solutions report, 2025 Brazil edition.
See Vultus's reference to the 2025 report · Read ISG's announcement for the 2025 Brazil edition.
Cyber risk does not have to remain hypothetical. It can be validated by evidence.
Manifesto
The era of autonomous attacks is already here.
AI has changed the cost and speed of offensive discovery. The manifesto sets out Vultus's view of a defense that investigates continuously, demonstrates impact and combines autonomy with governance.
Connect exposures, test the paths and review the evidence with specialists.
Read the manifesto →Governance
Autonomy needs controls.
Before testing starts, Vultus agrees on surfaces, access, objectives and execution limits. Tested paths and findings are recorded throughout the investigation. Specialists review the context, validate impact and guide the response.
policy · 01 ▣
Approved scope
Execution only on authorized surfaces.
policy · 02 ▣
Guardrails
Autonomy with limits agreed in advance.
policy · 03 ▣
Traceability
A record of hypotheses, evidence and decisions.
policy · 04 ▣
Human-in-the-loop
Specialists review findings and investigate further where needed.
policy · 05 ▣
Executive view
Findings translated into impact and priorities.
policy · 06 ▣
Continuous improvement
Retesting after fixes and new validation as the environment changes.
Offensive security is stronger with a hybrid model: machines for scale, specialists for depth.
FAQ
Questions that come up in the first conversation.
01 Which surfaces can ARES investigate?
Applications, APIs, integrations and mobile apps, along with OSINT and exposed-credential signals related to the scope. Targets, access and objectives are defined before each operation.
02 How is it different from a scanner?
Scanners help identify possible vulnerabilities. ARES investigates attack hypotheses, validates exploitation and documents how exposures can lead to impact. These activities complement each other.
03 Does AI replace the specialists?
No. Pentesters and red teamers retain responsibility for context analysis, limits and deeper technical investigation. Agent autonomy works with human oversight from Vultus.
04 How are the scope and limits defined?
The team works with your company to agree on authorized surfaces, access, objectives and testing limits. The demonstration runs within that approved scope, with oversight from Vultus.
05 What is the proprietary harness?
It is the orchestration layer built by Vultus to coordinate AI agents. It brings Red Team knowledge and TTPs into the investigation, within the limits defined for the operation.
06 How does mobile investigation work?
ARES combines virtualization, reverse engineering and language models to extract and analyze app information. This context supports new hypotheses, tests and evidence within the authorized scope.
07 Can ARES run between periodic pentests?
Yes. Recurring validation can follow changes to applications, APIs and mobile apps, as well as retesting after fixes. ARES complements periodic assessments.
08 What will I see in a demo?
An investigation within an approved scope, with tested paths, technical evidence and a review of findings. The discussion with our specialists defines the focus and how the results can guide remediation in your environment.
Access
Where does ARES fit in your environment?
Talk to our specialists about your digital surface and testing objectives. From there, we will agree on a demonstration scope with oversight from Vultus.
- Scope approved before execution
- Guardrails active during the operation
- Technical evidence for each finding
- Traceability for later review
Risk is not assumed.
It is proven.
Before it becomes an incident,
put ARES to the test.