Adversarial security testing, automated.

The annual-pentest problem.

Modern engineering organizations ship code every hour. Security testing that happens once a year — or even once a quarter — leaves a vulnerability window measured in months, not minutes.

SimpleSec replaces the annual-engagement model with continuous adversarial testing that runs every code push, opens a change-control ticket, and produces an audit-grade evidence trail. It automates the work a senior offensive-security consultant would do during an engagement — reconnaissance, enumeration, vulnerability validation, and exploitation — using the same real-world toolchain the consultant would.

Operators define a scope, pick the matching engagement persona, and the platform's planner decides which tool to run next based on what's been discovered. Findings stream into a dashboard with full per-step evidence; results export to PDF, JSON, AttackForge, and — new in 2026 — to your CI/CD pipeline with HMAC-signed completion webhooks, an audit-ready Compliance Archive, and integrated Software Composition Analysis (SCA) that never touches your source code.

Who it's for

An adaptive planner, not a static playbook.

A SimpleSec test isn't a fixed sequence of tools. Every step is a decision the planner makes from the current state of the engagement — discovered hosts, fingerprinted services, harvested credentials, and the persona's policy on what's in-scope at this phase. A judge decides continue / retry / pause after each step.

The four-phase model

Persona-aligned testing

The same target gets tested very differently depending on what it is. Personas constrain what the planner will attempt.

Internal testing — the WireGuard agent

A customer-deployable agent (Docker container or native WireGuard config) establishes an outbound tunnel to the platform. Tests run in the cloud, traffic routes through the agent, and the customer's network only needs to allow a single outbound UDP flow — no inbound firewall changes, no VPN appliance, no jump hosts. Each engagement gets its own agent and keypair; compromise of one customer's agent never gives access to another's network.

Adversarial testing in your pipeline.

SimpleSec's CI/CD integration — included with Enterprise — turns it into a build gate. Every push triggers a real adversarial test against the engagement's registered assets; results flow back as a signed webhook, an email-with-PDF, and a row in the Compliance Archive. The same integration runs SAST and Software Composition Analysis — one pipeline hookup gets you runtime adversarial, static, and dependency coverage at once.

The integration loop

1. Operator enables CI/CD on an Enterprise workspace. The API Keys card unlocks immediately — CI/CD scanning (DAST, SAST, and SCA) is included, no separate line item.
2. Generate an API key per CI environment. Each key is shown once, pbkdf2-hashed at rest, and independently revocable.
3. Pipeline POSTs to /api/v1/tests. Body carries the engagement id, commit SHA, ref, and callback URL. SimpleSec returns a run id and a one-time HMAC signing secret (HTTP 202).
4. Completion fans out three ways. A signed webhook (3 retries, exponential backoff); an email with the full PDF; and a Compliance Archive row for the auditor's review.
5. Pipeline gates on the result, or proceeds async. A promote-to-prod job consults /api/v1/tests/{id} and fails on a fail decision. Sync mode blocks the build until the test completes.

Dependency vulnerabilities, same pipeline.

Modern applications inherit most of their attack surface from open-source dependencies. SimpleSec's SCA mode catches the vulnerable package before it ships — using the OSV.dev advisory database that powers Google's own internal scanning — and lands the findings in the same Compliance Archive your auditor already reviews. No second portal, no second integration, no second invoice.

1. Your CI runs osv-scanner on every push. The official Google-maintained binary walks your repo recursively, parses every lockfile and SBOM (npm, pip, poetry, NuGet, Maven, Go, Cargo, Composer, RubyGems), and emits JSON.
2. The JSON is POSTed to SimpleSec. Same endpoint, same API key — only scan_type: "sca" differs. We never see your source code, only the parsed findings.
3. SimpleSec normalizes and persists every finding. CVE id, GHSA / advisory id, severity, affected package + version, fixed version, manifest path, transitive flag, and a deep link — de-duplicated per (vulnerability, package, version).
4. Findings land in the Compliance Archive. Filter Type → SCA for dependency findings, or leave it off for the full pre-deploy picture — DAST and SCA side by side, sorted by commit.
5. Severity gating uses the same policy as DAST. One threshold, one decision, one gate, regardless of coverage mode.

SAST, too. The same ingest pathway accepts Semgrep / CodeQL findings (scan_type: "sast") — static, dependency, and runtime coverage share one integration, one Compliance Archive, and one set of severity gates. Roadmap: gitleaks / trufflehog secret scanning via the same findings_format mechanism.

What's in the toolbox.

Every adapter is a real offensive-security tool, run with real flags against real targets. The planner picks which to run based on what the prior step discovered — and what the persona permits.

Reconnaissance & discovery

Web application testing

Active Directory + Windows

Evidence auditors actually want.

SimpleSec captures the full request/response of every confirmed finding inline, so the proof lives next to the finding instead of "see step 47." Reports export to PDF, JSON, AttackForge, and CSV — each format optimized for its audience.

Compliance Archive

Every CI-triggered test shows up with its commit SHA, engagement name, severity counts, decision (pass / warn / fail), webhook delivery status, test type (DAST or SCA), and a one-click PDF for DAST runs. Filter by workspace, engagement, decision, type, or date range — that's your quarterly evidence pack. Commit SHAs line up to change tickets, decision badges line up to your gating policy, and PDF reports capture the actual test execution. No more "we did testing, promise."

The audit log

Every consequential action — login, API key creation, scan trigger, webhook resend, plan change, asset registration — writes to a tamper-evident audit log with the originating user, IP, timestamp, and resource id. Retention 365 days by default.

Built by people who break things for a living.

SimpleSec is built by SUMMIT Cyber Group, a working pentest practice. Every adapter and workflow exists because a real engagement demanded it. We hold our own platform to the same security bar we hold our clients' to.

Deployment model. SimpleSec runs as a fully managed SaaS at app.simplesec.ai, on load-balanced, multi-server infrastructure with blue/green deployment — new releases go to a standby pool and traffic cuts over only once it's healthy, backing a 99.99% uptime commitment. Customer agents deploy as Docker containers or native WireGuard configs on customer infrastructure and only talk outbound — no inbound firewall changes needed.

Pricing that scales with your engagement.

Four tiers cover the path from solo evaluation through pipeline-native, enterprise-scale testing. CI/CD scanning — DAST, SAST, and SCA — is built into Enterprise.

Pro is the first-organization price; each additional organization bills $199.99/mo, with bulk discounts as you scale. Enterprise adds built-in CI/CD scanning (DAST, SAST & SCA) with volume pricing. Buying through our Gold reseller, Sanity Solutions, gets you gold-tier discount pricing on any paid tier.

Run one against your own perimeter.

The fastest way to evaluate SimpleSec is to run one. Free-tier signup is two clicks and starts a 7-day full-access trial — up to five tests in any 24-hour window, with the same complete findings and reports as the paid tiers — enough to see the planner in action and decide whether continuous adversarial testing belongs in your workflow.

• Sign up at app.simplesec.ai — email verification, optional MFA, ready in two minutes.
• Create an engagement against a target you own and register the host assets.
• Launch a test — watch the planner pick adapters in real time over a streaming WebSocket attack log.
• Ready for CI/CD? Enterprise mints an API key so your pipeline can curl /api/v1/tests — DAST, SAST, and SCA on every deploy.
• Watch it all land together — pipeline findings sit beside your manual DAST runs in one Compliance Archive.