Security Whitepaper

1. Executive Summary

All Seeing Eye (ASE) is an autonomous AI-powered penetration testing platform designed for cybersecurity companies. ASE enables security teams to conduct comprehensive, continuous penetration testing engagements with the speed and consistency of automation, while maintaining the depth and adaptability of human-driven assessments.

This whitepaper provides a comprehensive overview of ASE's security architecture, AI safety controls, data protection mechanisms, and compliance posture. It is intended for security teams, compliance officers, and technical evaluators conducting vendor risk assessments.

Core security principles:

  • Single-tenant architecture: every client receives a dedicated, isolated compute instance.
  • Zero data persistence: assessment data is purged after the client downloads the report or after the retention window expires (default: 72 hours).
  • Defense in depth: multiple independent safety layers prevent unsafe behavior, none relying solely on AI model reasoning.
  • Privacy by design: sensitive data is automatically redacted from all internal logs and storage.

2. Platform Architecture

2.1 Single-Tenant Compute

Each ASE client receives a dedicated compute instance with a static IP address. Instances are provisioned exclusively for a single client and are never shared across organizations. This architecture eliminates cross-tenant data leakage by design, as there is no shared infrastructure at the application layer.

2.2 Architecture

ASE operates on a dedicated-instance model designed for isolation and client data control:

  • Dedicated Infrastructure: Each client is provisioned a single-tenant server instance with its own database, encryption keys, and a static IP address. No infrastructure is shared between clients. Isolation is enforced at the infrastructure level, not application logic. Clients may whitelist the dedicated IP in their WAF configuration for streamlined assessment connectivity (recommended).
  • Local Client: A local application runs on the client's own machine, providing a local web interface and a local database. The local client communicates with the dedicated server over HTTPS with mutual authentication. Assessment results are downloaded and stored locally. The client retains the authoritative copy of all reports on their own infrastructure.
  • Server-Side Data Lifecycle: Assessment data on the dedicated server is encrypted at rest (AES-256-GCM) with per-client keys. Authentication credentials supplied for grey-box assessments are encrypted in memory and wiped immediately upon assessment completion. They are never persisted beyond the active engagement. Reports are automatically purged from the server after download or after the retention window expires (default: 72 hours). Working directories used during assessments are destroyed on completion.

This model gives clients the operational convenience of a managed platform while ensuring they maintain custody of their own results and that no assessment data persists on ASE infrastructure beyond the active engagement window.

2.3 Hosting Infrastructure

ASE's infrastructure is hosted on providers that maintain SOC 2 Type II certification, ensuring that organizational and operational controls are independently audited on a continuous basis.

2.4 Network Isolation

Each client instance operates in an isolated network segment. Network-level controls prevent lateral movement between instances. Outbound connectivity is restricted to the authorized target scope and ASE platform services only.

3. AI Safety Architecture

ASE employs a layered safety architecture where multiple independent mechanisms enforce safe behavior. No single component relies exclusively on AI model reasoning for security-critical decisions.

3.1 Independent Safety Judge

A dedicated safety component, architecturally separate from the execution agents, evaluates every action before it is permitted. The Safety Judge operates on deterministic rules, not model reasoning. This architectural separation ensures that security controls cannot be bypassed through prompt injection, agent manipulation, or emergent behavior.

The Safety Judge evaluates each proposed action against the defined security policies, authorized scope, and potential impact. Actions that violate any policy are blocked before execution, regardless of the reasoning provided by the executing agent.

3.2 Deterministic Command Controls

Every command an agent attempts to execute is intercepted and evaluated against deterministic allowlists and blocklists before execution. Command arguments are analyzed for risk, and operations such as file deletion, credential modification, or database writes are blocked at the platform level, independent of the AI model's reasoning.

These controls are implemented as hard-coded rules that cannot be influenced by prompt content or model output, providing a reliable safety boundary regardless of agent behavior.

3.3 Safe Mode by Default

ASE operates in non-destructive mode by default. This means:

  • No data modification on the target system.
  • No data deletion.
  • No account lockout.
  • No production exploitation.

All vulnerabilities are confirmed through safe, non-impactful validation techniques designed to minimize risk to the target environment.

3.4 Deterministic Scope Enforcement

The authorized target scope is enforced at the network level via allowlists. Agents cannot interact with systems outside the defined scope, regardless of prompt content or model-generated instructions. This prevents scope creep and ensures that assessments remain within the boundaries agreed upon with the client.

3.5 Prompt Injection Defenses

All output received from target systems is treated as untrusted input. ASE implements multiple layers of defense against prompt injection attacks:

  • Output filtering: responses from target systems are sanitized before being processed by the AI model.
  • Input sanitization: model-generated commands are validated against deterministic rules before execution.
  • Sandboxed execution: each tool and command runs in an isolated environment with restricted permissions.

3.6 Egress Control

Outbound connectivity from ASE instances is strictly restricted. Only connections to the authorized target scope and ASE platform services are permitted. All other outbound traffic is blocked at the network level, preventing data exfiltration and unauthorized communication.

4. Automated Target Protection

4.1 Continuous Health Monitoring

ASE continuously monitors the target's availability and response patterns during assessments. Key metrics tracked include response time, error rates, and service availability. This monitoring operates independently of the AI agents and provides real-time visibility into the target's health status.

4.2 Automatic Pause and Recovery

If the target shows elevated error rates, increased latency, or becomes unresponsive, testing is automatically paused until conditions recover. This mechanism operates at the platform level and cannot be overridden by the AI agents. Assessments resume automatically once the target returns to normal operating parameters.

4.3 Agent Behavior Monitoring

The platform monitors agent behavior patterns and detects agents that repeatedly attempt blocked actions. Such agents are automatically halted to prevent resource waste and potential impact on the target.

4.4 Emergency Stop

ASE provides a kill switch that enables immediate halt of all assessment activity. This can be triggered manually by the user or automatically by the platform when predefined safety thresholds are exceeded.

5. Vulnerability Validation

5.1 Dual Validation Approach

ASE employs a dual validation approach that combines AI-based analysis with independent, programmatic validation mechanisms. Findings identified by the AI agents are verified through purpose-built validators that operate outside the AI model, ensuring that every reported vulnerability is confirmed through observable, measurable evidence.

5.2 Purpose-Built Validators

ASE includes specialized validators for specific vulnerability classes:

  • SQL Injection: controlled probes that verify observable differences in server responses.
  • SSRF: verification through interactions with controlled endpoints.
  • Path Traversal: confirmation of access to resources outside permitted directories.
  • XSS: execution verification in controlled rendering contexts.
  • Additional classes: specialized validators for RCE, IDOR, authentication bypass, and other common vulnerability categories.

5.3 Vulnerability Validation Layer

Every vulnerability reported by ASE goes through an AI-powered validation layer that independently verifies exploitability with observable, measurable evidence. This process drastically reduces false positives, ensuring that findings in the report are reproducible and actionable.

6. Data Protection

6.1 Encryption

  • At rest: all stored data is encrypted using AES-256-GCM. Encryption keys are managed per-client and rotated regularly.
  • In transit: all communications use TLS 1.3. Older protocol versions are not supported.

6.2 Automatic Secret Redaction

Credentials, API keys, tokens, PII, and other sensitive data encountered during assessments are automatically redacted from internal logs and storage. This ensures that sensitive information is never persisted in plain text within ASE infrastructure.

6.3 Zero Cross-Contamination

Each engagement starts from a clean state on the client's dedicated instance. No data from previous engagements is present when a new assessment begins. This design eliminates the risk of cross-contamination between engagements.

6.4 No Model Training on Client Data

ASE does not use client assessment data to train, fine-tune, or improve AI models. This commitment is contractually binding and ensures that client data is never incorporated into model weights or training datasets.

6.5 Data Processing Agreement

A formal Data Processing Agreement (DPA) is available to all clients, defining the terms and conditions for data processing in compliance with applicable data protection regulations. See our Data Processing Agreement for details.

7. Tooling and Supply Chain

7.1 Open-Source Tooling

ASE integrates industry-standard open-source security tools, including nmap, Nuclei, ffuf, sqlmap, among others. These tools are selected for their proven reliability, community support, and widespread adoption in professional penetration testing.

7.2 Supply Chain Controls

  • Pinned versions: all tool versions are pinned and tracked. Updates are applied after internal review and validation.
  • Integrity verification: cryptographic integrity checks are performed on all tool binaries and dependencies.
  • Isolated execution: each tool runs in an isolated execution environment with restricted permissions, limiting the blast radius of any potential supply chain compromise.

7.3 Internal Security Practices

  • Internal code review and static analysis on every release.
  • Regular third-party penetration testing of the ASE platform itself.
  • Continuous monitoring of dependency vulnerability databases.

8. Compliance Posture

ASE aligns with widely recognized security standards and frameworks:

Standard / Framework Status Details
OWASP Top 10 Covered Full coverage of OWASP Top 10 vulnerability categories in assessments
CVSS 4.0 Adopted All findings scored using CVSS 4.0 methodology
CWE Adopted Findings mapped to Common Weakness Enumeration identifiers
PTES Aligned Assessment methodology aligned with the Penetration Testing Execution Standard
ISO/IEC 42001 Aligned AI management system practices aligned with ISO/IEC 42001 requirements
SOC 2 Type II Infrastructure certified Hosting infrastructure maintains SOC 2 Type II certification
GDPR Aligned Data processing practices aligned with GDPR requirements. DPA available.

9. Incident Response

ASE maintains a formal incident response plan covering security incidents that may affect client data or platform integrity. The plan follows four phases:

9.1 Detection

Continuous monitoring of platform infrastructure, access logs, and operational metrics for indicators of compromise or anomalous behavior.

9.2 Containment

Immediate isolation of affected systems to prevent further impact. Assessment activity on affected instances is halted pending investigation.

9.3 Notification

Affected clients are notified within 72 hours of confirmed incidents involving their data, in compliance with applicable data protection regulations. Notifications include a description of the incident, the data potentially affected, and remediation steps taken.

9.4 Remediation

Root cause analysis is performed, corrective measures are implemented, and affected systems are restored to a known-good state. Post-incident reports are made available to affected clients upon request.

Security incidents can be reported to security@ase.run.

10. Responsible Use

ASE is designed exclusively for authorized security assessments. The platform enforces responsible use through the following mechanisms:

  • Authenticated access: all assessments require authenticated users with verified identity.
  • Scope definition: the target scope must be defined and confirmed before any assessment begins.
  • Authenticated users: each assessment is tied to an authenticated user account.
  • Abuse detection: continuous monitoring for patterns that indicate misuse or unauthorized testing.

Guidance for Clients

Organizations using ASE should ensure that their Rules of Engagement (RoE) and Statement of Work (SOW) with their end clients reflect the use of AI-powered testing tools. This ensures transparency and appropriate authorization for automated assessment activities.

11. Contact

For questions about this whitepaper, security inquiries, or to request additional technical documentation:

Related Documents