Bendings Gauge
Bendings Gauge is our own AI model for continuous red and blue team work. It tests and watches your organization around the clock, inside limits you approve, with our operators in the loop.
Gauge, in three and a half minutes.
Black October, then one night at a synthetic site: Gauge attacks inside the signed scope at 01:10 and catches a badge and an account working together at 02:14, with an operator approving every risky step.
Read the film as text
- October 2026. 20 October: browsers stop trusting eight certificate authority keys. 21 October: PHP ships emergency fixes for two critical flaws; an AI package ships with credential-stealing malware; GitLab fixes a critical flaw in self-managed servers. 22 October: the NSA tells organizations to patch urgently. Black October: five incidents, three days.
- The PHP flaws were found with the help of AI. Attackers use the same tools. A yearly penetration test looks at one day. Attackers get the other 364. Attacks now run around the clock, and your testing has to as well.
- Bendings Gauge, our own AI model for continuous red and blue team work. Red team: it probes the systems in scope day and night, the way a patient adversary would. Blue team: it hunts through your logs and alerts around the clock for activity your detections missed. Inside limits you approve, with our operators in the loop.
- 01:10, a synthetic site. Gauge maps every system inside the signed scope and finds a weak point in the remote access portal. Exploitation waits for an operator, who approves at 01:24. It moves the way an attacker would; a route out of scope is refused, whatever it finds. It reaches the agreed objective, the ledger database, and reports to your team with evidence before morning. The portal is fixed and tested again the next night.
- 02:14, the same site seen as a building. On Bendings Frame, Gauge sees doors, cameras, identity and network as one picture. Badge 4471 opens the North Service Door; two people pass on one badge read; the badge holder is on leave all week. At 02:19 the same person’s account unlocks workstation FIN-14, and a ledger export starts at thirty times the usual volume. Alone, none of these would wake anyone; together, they are one path. Approval is requested to suspend the badge and isolate FIN-14, for that badge and that workstation only. A Bendings operator approves at 02:22. The badge is suspended, FIN-14 is isolated and the export stops part way. Caught at 02:22, not in next year’s test.
- How it stays inside the lines: the five controls listed further down this page, ending with the log of every action, which is handed to you.
- Bendings, since 2013. Our team has tested organizations worth more than $2 trillion combined, in aerospace, AI infrastructure, government and security companies. Their names stay under NDA. One team breaks in, and defends. Cleared staff, at home in the United States and across the Gulf.
- Attackers now work around the clock. So does Gauge.
What it answers.
- What could an adversary do to us this week, not only in the month of our annual test?
- Would anyone notice an intrusion at three in the morning on a public holiday?
- What has changed in our exposure since the last engagement?
Red team, continuously
Gauge probes the systems in scope day and night the way a patient adversary would, looking for a path to the objectives you approve.
Blue team, continuously
Gauge hunts through the logs and alerts you give it access to, around the clock, for activity your detections missed, and raises what it finds with your team and ours.
How it stays inside the lines.
-
Scope it cannot leave
Gauge itself refuses any target outside the signed scope, whatever it finds along the way.
-
Operators approve risky steps
Exploitation, lateral movement and other risky actions wait for a Bendings operator to approve them.
-
You can stop it at any time
A named person on your side can halt Gauge immediately.
-
It runs where your data lives
Inside your network, in your country or fully air-gapped. Your data stays there and is never used to train the model.
-
Every action on record
Gauge logs each action it takes, and the complete log is handed to you.
Gauge does not replace the people on an engagement. Our operators set its limits, approve its riskier steps and answer to you for its work. It runs on Bendings Frame, the operating system our team works in.
About Bendings FrameWhat you receive.
- Continuous offensive testing, defensive hunting or both, inside the scope you sign
- A named Bendings lead who answers for Gauge’s work
- The complete log of every action Gauge takes
- Technical documentation of the model under a nondisclosure agreement
What we need from you.
- A signed scope and written authorization for everything Gauge may touch
- A named person on your side who can stop it
- A place to run it: your network, your country or an isolated environment
- For defensive work, read access to the logs and alerts it should watch
Ask how Gauge would run in your environment.
Write from your organization's email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.