A COMPLETE ENGAGEMENT, END TO END

What actually happens during a Fleuret run.

Several agents work your surface at once, raise leads, and drop the ones the evidence does not support. What survives is tested for real and reproduced before it is reported. Click any agent to follow its reasoning.

SIMULATED RUNapp.northwind-health.eu

ReportT+04:00:00

reporterSigned PDF and Jira tickets delivered

HYPOTHESES

H-01CONFIRMED9.1worth testingCross-tenant read on /api/v1/invoices/{id}12,400 patient invoices readable across tenants

H-02REFUTEDdroppedSQL injection on /search

H-03REFUTEDdroppedDiscount stacking on /checkout

H-04CONFIRMED7.4worth testingAdmin panel reachable with a member tokenPrivilege escalation path from any authenticated account

Validated2Refuted2Reported without proof0

PROOF OF CONCEPT · H-01

# Tenant A token, Tenant B resource
curl -s https://app.northwind-health.eu/api/v1/invoices/88421 \
     -H "Authorization: Bearer $TENANT_A_JWT"

HTTP/1.1 200 OK
{"id":88421,"tenant":"B","patient_ref":"NH-33...","amount":1840.00}

Illustrative run on a fictional target · not a live scan

WHAT YOU JUST WATCHED

Five things that make the difference

Each one is visible in the console above, and each one ends with where to look for it.

01DEPTH

It asks questions about your application

A scanner checks your responses against a list. A pentester asks whether a rule is actually enforced.

The questions come from what the run just observed on your system, so they cannot be written in advance. That is why business logic is reachable at all.

↑ the four hypotheses, written as questions rather than verdicts

02SPEED

Several agents work at once

Different parts of your surface are tested in parallel, and each agent builds on what the others find.

A wider estate means more agents rather than more weeks. It also means a finding that only makes sense from two different angles still gets found.

↑ the agents lighting up together in the opening seconds

03FOCUS

Weak leads are dropped, not tested

Most ideas are settled by evidence long before anyone spends an attempt on them.

Only the leads that hold up get pursued for real. You are paying for judgement about where to look, not for a brute-force sweep of everything.

↑ a hypothesis fading out without ever being attempted

04COVERAGE

What was cleared ships with what was found

An attempt that comes back negative is a result, and it goes in the report.

Your auditor asks what was examined, not only what broke. A findings list alone cannot answer that question, and this is the half that gets signed against.

↑ hypotheses marked as dropped, kept on screen to the end

05PROOF

Nothing is reported until it is reproduced

Every candidate is reproduced independently before it is allowed to become a finding.

What survives arrives with a proof your engineer can replay. Cutting false positives is a step in the process here, not a line in a brochure.

↑ the proof of concept captured at the end of the run

06OVER TIME

The next engagement starts ahead

What was learned about your application is kept, not rediscovered every time.

A re-test already knows what was cleared last time and what was argued about, so the work goes into what changed. You stop paying twice for the same groundwork.

We will run this on your real perimeter.

Book a demo