Penetration testing that can't leave the agreed scope.
Prismara Crucible is SovSec's automated penetration testing platform. The scope you sign off compiles into a default-deny policy that sets what may be tested and how hard, so the agreement itself is the enforcement boundary. You get prioritised, ATT&CK-mapped findings and a report at the end of every test, delivered as a SovSec service.
See it working
Shown with sample data.
What Prismara Crucible does
Scope as policy
The signed authorisation to test compiles into a policy checked on every action. Anything not explicitly allowed is refused.
Ownership checks
Targets are verified by DNS TXT record or a file on the web server before any active test.
Graded intensity
Passive inventory (T0), discovery (T1) and non-destructive validation (T2). Your scope sets the ceiling, and deeper tiers stay disabled.
Prioritised findings
Enriched with CVE data and ranked by CISA known-exploited status, then EPSS likelihood, then CVSS severity.
ATT&CK reporting
Every finding maps to MITRE ATT&CK, and tested techniques export as an ATT&CK Navigator layer.
Report after every test
Each engagement ends with a generated report of what was tested, what was found and how to harden it.
Purple-team view
Compare the techniques exercised with what Prismara SOC detected.
How it's secured
Prismara Crucible follows the engineering rules shared across the suite, plus these product-specific measures.
Signed authorisation
Nothing runs without an Ed25519-signed authorisation to test, and the platform cannot act outside it.
Out-of-scope carve-outs
Excluded addresses inside an approved range are removed before testing starts.
Vetted modules only
Test modules load only if signed and permissively licensed.
Run by SovSec
Tests are operated by SovSec, never handed to third parties for self-service use.
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.