Products

ACID is a customizable, agentic security platform designed to deliver adaptive vulnerability discovery across modern applications. Built by veteran vulnerability researchers at Off By One, it moves beyond traditional scanners and scripted automation by applying real reasoning to how systems are tested.

ACID deploys swarms of autonomous micro agents that communicate, infer, and learn in real time. Each agent contributes specialized analysis, transforming what is typically manual and episodic testing into an intelligence driven process that maintains context across engagements.

Whether assessing APIs, web applications, LLM driven interfaces, or AI assisted SaaS platforms, ACID delivers the depth and judgment of experienced researchers with the consistency and scale of automation.

1. Connector Agent: Establishes a secure encrypted tunnel that allows internal and external testing without exposing sensitive networks or requiring perimeter access control changes.
2. Workflow Validation: Understands authentication flows, normalizes data, and can auto-correct malformed or incomplete API specifications for accurate testing.
3. Micro-Agent Swarm: A network of specialized agents performs reconnaissance, inference, fuzzing, and exploitation in coordinated real time to simulate realistic adversary behavior.
4. Central Intelligence Engine: Holds long-term memory across sessions, learning from every engagement to refine future operations and improve precision.
5. Dashboard and Integrations: Findings are visualized and can flow directly into Slack, Jira, GitHub, GitLab, or CI/CD pipelines for immediate collaboration.
6. Reporting and Remediation: Delivers clear, validated results by endpoint, bug class, and severity with reproducible proof of concept data and actionable remediation steps.

• Agentic AI Intelligence: ACID uses reasoning driven micro agents that collaborate rather than execute static scans, producing findings grounded in context and behavior.
• Broad Application and API Coverage: Identifies complex vulnerabilities including authorization failures, injection flaws, and business logic abuse across REST, GraphQL, web applications, and modern service architectures.
• Chatbot and LLM Security Testing: Evaluates AI powered interfaces for risks such as prompt injection, jailbreaks, data exposure, and misuse of model capabilities that impact real systems.
• Adaptive Learning: Improves accuracy over time by retaining context and refining tactics based on prior engagements and observed behavior.
• On Demand Operation: Designed for repeatable testing when teams need it, with simple configuration that supports rapid retesting as systems change.
• High Fidelity Reporting: Produces human readable, validated results that explain impact, reproduction steps, and provide clear remediation guidance to support effective fixes.
• Secure and Flexible Deployment: Delivered as a cloud hosted platform with encrypted communication and strong data isolation. A customer side connector enables testing to originate from within the environment without inbound firewall changes. Integrates into developer and security workflows through CI CD pipelines, with reports available in PDF, HTML, JSON, and Excel formats.

• Identifies authorization and access control flaws such as BOLA, BOPLA, and BFLA across complex API ecosystems.
• Tests authentication logic including JWT handling, token misuse, and session trust boundaries.
• Discovers injection and logic flaws that emerge from real request flows, not just specifications.
• Maintains context across endpoints to uncover chained issues and systemic API weaknesses.

• Evaluates AI interfaces for prompt injection, jailbreaks, and unintended instruction execution.
• Detects data exposure risks including sensitive data leakage and unintended information access.
• Assesses excessive agency scenarios where models gain more authority than intended.
• Tests real-world abuse cases that impact availability, integrity, and downstream systems.

• Identifies injection flaws such as SQL injection, command injection, and server-side request forgery.
• Tests authentication, authorization, and session handling across application workflows.
• Discovers client and server-side issues including cross-site scripting and data exposure.
• Uncovers misconfigurations and logic errors that scanners often overlook.

• Analyzes source code using context-aware reasoning rather than pattern matching alone.
• Identifies security flaws tied to business logic, data flow, and implementation decisions.
• Produces validated, actionable findings mapped directly to affected code paths.
• Supports development teams with clear remediation guidance grounded in how the code behaves.