Cybersecurity AI · the Cordon product line
The audit that shows its work.
Cordon is a multi-phase security audit run by a fleet of agents against your source. It is built for the moment after the report lands — when someone asks “how do you know?” — and for that question to have a boring, documentary answer.
Operating modes
Two ways in.
Not every question needs a six-phase audit, and pretending otherwise wastes your money.
A focused question, answered
You have a specific concern — an upload path, a session flow, a dependency — and want an expert read on the actual weakness, with the code path to match. Shorter turnaround, no artifact overhead.
A codebase, covered and accounted for
Six phases, a coverage ledger, schema-validated findings, independent verification and a written report. For teams that need to show diligence, not just hear an opinion.
Deliverables
What actually lands in your inbox.
- findings.json — every record, validated against a published schema. Machine-readable, ticket-ready.
- REPORT.md — the audit read by a decision-maker: what was in scope, what was found, what it means, what to do first.
- FINDINGS-DETAIL.md — per-finding source trace, observed result, impact, and the smallest effective fix.
- NEEDS-VALIDATION.md — hypotheses that could not be settled from source, each with the exact missing fact and a safe way to settle it.
- coverage-ledger.json — what was audited, what was deferred, and what was out of scope. The honest boundary of the run.
Severity
What each label commits us to.
Severity is a claim with consequences. These are the anchors we calibrate against, applied only to confirmed findings.
| Label | Means |
|---|---|
| Critical | An unauthenticated actor gains code execution, full data-store access, or takeover of arbitrary accounts. |
| High | An explicit security control is fully defeated with real consequences: authentication bypass, cross-tenant read or write, stored script execution against other users. |
| Medium | A real boundary violation with limited blast radius, uncommon preconditions, or consequences confined to a narrow resource set. |
| Low | Disclosure of non-secret internals, or an effect requiring sustained effort for minimal gain. |
| Needs validation | Not a severity. A source-grounded hypothesis blocked by a fact outside the repository, carrying the exact open question. |
A defense-in-depth gap is not a vulnerability. If one control prevents the attack, the absence of another is a hardening note, not a finding — and we say so in those words.
Rules of engagement
What we will not do.
- We do not probe your production environment, or anyone else's.
- We do not execute untrusted code outside an isolated sandbox with egress blocked; if that isn't available, the finding stays needs_validation rather than being guessed at.
- We do not publish, disclose or reuse your code or findings without written authorisation.
- We do not inflate a report to justify an invoice. A clean audit is a legitimate outcome.
Scope & pricing
Priced per cycle, not per hour.
Audits are quoted after a short reconnaissance call, because a four-service API and a payments platform are not the same job.
Standing audit
From USD 500 / month
One application per cycle, with a re-run against your fixes included.
Request a proposal →Where scope usually stops
Live penetration testing against deployed infrastructure, social engineering, physical assessment and 24/7 monitoring are separate engagements. We would rather name the boundary than quietly imply it isn't there.
Ask us the hard question first.
Send us the repository's shape — language, services, what it exposes — and we'll tell you what a first cycle would cover and what it would cost.
Start a conversation →