Adversarial security testing, automated.

The annual-pentest problem.

Modern engineering organizations ship code every hour. Security testing that happens once a year — or even once a quarter — leaves a vulnerability window measured in months, not minutes.

SimpleSec replaces the annual-engagement model with continuous adversarial testing that runs every code push, opens a change-control ticket, and produces an audit-grade evidence trail. It automates the work a senior offensive-security consultant would do during an engagement — reconnaissance, enumeration, vulnerability validation, and exploitation — using the same real-world toolchain the consultant would.

Operators define a scope, pick the matching engagement persona, and the platform's planner decides which tool to run next based on what's been discovered. Findings stream into a dashboard with full per-step evidence; results export to PDF, JSON, AttackForge, and — new in 2026 — to your CI/CD pipeline with HMAC-signed completion webhooks, an audit-ready Compliance Archive, and integrated Software Composition Analysis (SCA) that never touches your source code.

Who it's for

An adaptive planner, not a static playbook.

A SimpleSec test isn't a fixed sequence of tools. Every step is a decision the planner makes from the current state of the engagement — discovered hosts, fingerprinted services, harvested credentials, and the persona's policy on what's in-scope at this phase. A judge decides continue / retry / pause after each step.

The four-phase model

Persona-aligned testing

The same target gets tested very differently depending on what it is. Personas constrain what the planner will attempt.

Internal testing — the WireGuard agent

A customer-deployable agent (Docker container or native WireGuard config) establishes an outbound tunnel to the platform. Tests run in the cloud, traffic routes through the agent, and the customer's network only needs to allow a single outbound UDP flow — no inbound firewall changes, no VPN appliance, no jump hosts. Each engagement gets its own agent and keypair; compromise of one customer's agent never gives access to another's network.

Adversarial testing in your pipeline.

The CI/CD add-on turns SimpleSec into a build gate. Every push triggers a real adversarial test against the engagement's registered assets; results flow back as a signed webhook, an email-with-PDF, and a row in the Compliance Archive. The same add-on includes Software Composition Analysis — one pipeline integration gets you both runtime adversarial coverage and dependency-vulnerability coverage at once.

The integration loop

1. Operator enables CI/CD on a Pro workspace. A flat monthly add-on plus a metered overage line attach to the subscription. The API Keys card unlocks immediately.
2. Generate an API key per CI environment. Each key is shown once, pbkdf2-hashed at rest, and independently revocable.
3. Pipeline POSTs to /api/v1/tests. Body carries the engagement id, commit SHA, ref, and callback URL. SimpleSec returns a run id and a one-time HMAC signing secret (HTTP 202).
4. Completion fans out three ways. A signed webhook (3 retries, exponential backoff); an email with the full PDF; and a Compliance Archive row for the auditor's review.
5. Pipeline gates on the result, or proceeds async. A promote-to-prod job consults /api/v1/tests/{id} and fails on a fail decision. Sync mode blocks the build until the test completes.

Dependency vulnerabilities, same pipeline.

Modern applications inherit most of their attack surface from open-source dependencies. SimpleSec's SCA mode catches the vulnerable package before it ships — using the OSV.dev advisory database that powers Google's own internal scanning — and lands the findings in the same Compliance Archive your auditor already reviews. No second portal, no second integration, no second invoice.

1. Your CI runs osv-scanner on every push. The official Google-maintained binary walks your repo recursively, parses every lockfile and SBOM (npm, pip, poetry, NuGet, Maven, Go, Cargo, Composer, RubyGems), and emits JSON.
2. The JSON is POSTed to SimpleSec. Same endpoint, same API key — only scan_type: "sca" differs. We never see your source code, only the parsed findings.
3. SimpleSec normalizes and persists every finding. CVE id, GHSA / advisory id, severity, affected package + version, fixed version, manifest path, transitive flag, and a deep link — de-duplicated per (vulnerability, package, version).
4. Findings land in the Compliance Archive. Filter Type → SCA for dependency findings, or leave it off for the full pre-deploy picture — DAST and SCA side by side, sorted by commit.
5. Severity gating uses the same policy as DAST. One threshold, one decision, one gate, regardless of coverage mode.

Roadmap: the same ingest pathway will accept Semgrep / CodeQL (SAST) and gitleaks / trufflehog (secrets) via additional findings_format discriminators — one integration, one Compliance Archive, one set of severity gates for your entire pipeline-security story.

What's in the toolbox.

Every adapter is a real offensive-security tool, run with real flags against real targets. The planner picks which to run based on what the prior step discovered — and what the persona permits.

Reconnaissance & discovery

Web application testing

Active Directory + Windows

Evidence auditors actually want.

SimpleSec captures the full request/response of every confirmed finding inline, so the proof lives next to the finding instead of "see step 47." Reports export to PDF, JSON, AttackForge, and CSV — each format optimized for its audience.

Compliance Archive

Every CI-triggered test shows up with its commit SHA, engagement name, severity counts, decision (pass / warn / fail), webhook delivery status, scan type (DAST or SCA), and a one-click PDF for DAST runs. Filter by workspace, engagement, decision, type, or date range — that's your quarterly evidence pack. Commit SHAs line up to change tickets, decision badges line up to your gating policy, and PDF reports capture the actual test execution. No more "we did testing, promise."

The audit log

Every consequential action — login, API key creation, scan trigger, webhook resend, plan change, asset registration — writes to a tamper-evident audit log with the originating user, IP, timestamp, and resource id. Retention 365 days by default.

Built by people who break things for a living.

SimpleSec is built by SUMMIT Cyber Group, a working pentest practice. Every adapter and workflow exists because a real engagement demanded it. We hold our own platform to the same security bar we hold our clients' to.

Deployment model. SimpleSec runs as a fully managed SaaS at app.simplesec.ai. Customer agents deploy as Docker containers or native WireGuard configs on customer infrastructure and only talk outbound — no inbound firewall changes needed.

Pricing that scales with your engagement.

Three tiers cover the path from solo evaluation through managed-service operation, with an optional CI/CD add-on that layers onto Pro workspaces.

Standard and Pro are 80% off during early access — $99.99 and $199.99/mo for your first year, then $499.99 and $999.99/mo. Pro is the first-workspace price; each additional workspace bills $99.99/mo (regularly $499.99). The CI/CD add-on is $99.99/mo flat + $5 per triggered test beyond 50 included per month — SCA dependency scanning included, no second invoice.

Run one against your own perimeter.

The fastest way to evaluate SimpleSec is to run one. Free-tier signup is two clicks and starts a 7-day full-access trial — up to five scans in any 24-hour window, with the same complete findings and reports as the paid tiers — enough to see the planner in action and decide whether continuous adversarial testing belongs in your workflow.

• Sign up at app.simplesec.ai — email verification, optional MFA, ready in two minutes.
• Create an engagement against a target you own and register the host assets.
• Launch a test — watch the planner pick adapters in real time over a streaming WebSocket attack log.
• Try the CI/CD trigger — mint an API key, curl /api/v1/tests, watch it run from outside the dashboard.
• Add SCA in one snippet — run osv-scanner, POST the JSON, watch findings land beside your DAST runs.