Penetration testing that can't leave the agreed scope.
Prismara Crucible is SovSec's automated penetration testing platform. The signed rules of engagement compile into a default-deny policy that every test action must pass, so the agreed scope is the enforcement boundary. It is delivered as a SovSec service and is not sold for self-service use.
See it working
Taken from the working demo, using sample data.
What Prismara Crucible does
Scope as policy
The signed authorisation to test compiles into a policy checked on every action. Anything not explicitly allowed is refused.
Ownership checks
Targets are verified by DNS TXT record or a file on the web server before any active test.
Graded intensity
Passive inventory (T0), discovery (T1) and non-destructive validation (T2) at launch. Deeper tiers stay disabled.
Prioritised findings
Ranked by CISA known-exploited status, then EPSS likelihood, then CVSS severity.
ATT&CK reporting
Export tested techniques as a MITRE ATT&CK Navigator layer.
Purple-team view
Compare the techniques exercised with what Prismara SOC detected.
How it's secured
Prismara Crucible follows the engineering rules shared across the suite, plus these product-specific measures.
Signed authorisation
Nothing runs without an Ed25519-signed authorisation to test, and the platform cannot act outside it.
Out-of-scope carve-outs
Excluded addresses inside an approved range are removed before testing starts.
Vetted modules only
Test modules load only if signed and permissively licensed.
Run by SovSec
Tests are operated by SovSec, never handed to third parties for self-service use.
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.