Continuous Assessments

Continuous assessments
that exploit, not just report

Multi-stage attacks against your REST and GraphQL APIs, launched from the console, the CLI or a GitHub Action, and re-reviewed against their own evidence before they reach you.

Book a Live Demo Read the Docs

Engagement · payments-apicontinuous

Auth bypass · /api/sessionExploited

IDOR · /api/payouts/:idExploited

Verbose error · /healthnot exploitable

Fewer theoretical flags, with the proven exploits first

What reaches your teamShare of candidate issuesCheck

Nullify

re-reviewed

Exploit attempted

tried

Theoretical flag

might be vulnerable

Illustrative example. Real ratios depend on your APIs.

3

ways to launch: the Nullify console,
the CLI or a GitHub Action

2

API styles in scope,
REST and GraphQL

Move from a point-in-time report
to attacks that keep running as your APIs change

Exploit

Attacks the way an attacker would

Chains requests into active, multi-stage exploits against REST and GraphQL endpoints, with no operator driving each step.

Assessment steps · live

POST /api/session {"role":"admin","sig":null}

200 OK · admin session issued

GET /api/payouts/8841 · forged session

Another tenant's payout record returned

Re-review

✓Exploit reproduced. Checked against its own evidence.

evidence · auth bypass

request / response pairs ✓
screenshots ✓
exploit video ✓

Evidence

Ships with proof you can open

Every validated finding includes request/response pairs, screenshots and video of the exploit, enough to verify it without re-running the engagement.

From a route map to a reproduced attack

Each stage narrows the list. A finding reaches your team only after Nullify has exploited it and re-reviewed the exploit against its own evidence.

01

Launch

02

Map

03

Attack

04

Re-reviewed

Every successful exploit is independently re-reviewed against its recorded evidence before it's reported.

ExploitedAuth bypass · POST /api/session

Re-review confirmed · evidence attached

Forge a session with an unsigned role claim
Request admin-only payout data
Receive another tenant's records

Request/response, screenshots, videoReproducible

Engagements launch from where your team already works

Start an engagement from the Nullify console, the CLI or the Pentester GitHub Action. It runs continuously and hands-off, so findings surface as your APIs change.

Terminal · nullify CLI

$ nullify pentest run --target payments-api
→ mapping routes · REST + GraphQL in scope … engagement running · continuous

Nullify console · engagements

Nullify2:07 PM

Engagement on payments-api: 2 exploits confirmed and re-reviewed, evidence attached.

Finding · evidence

Exploitedpayments-api · POST /api/session

Auth bypass via unsigned role claim

nullify re-reviewed this exploit

The session endpoint accepts a role claim without checking its signature, so a forged admin session can read payout data.

request/responsescreenshotsvideo

›_ request200 OK

>  POST /api/session
>  {"role":"admin","sig":null}
<  200 OK · admin session issued
   # verify the signature before trusting the role claim

A pentest report is a snapshot, while Nullify keeps attacking as your APIs change

Attack continuously

Engagements keep running without an operator, so new endpoints and changes get tested as they ship.

Chain multi-stage exploits

Re-review every exploit

Attach the evidence

Engagement · payments-apiRunning

FindingExploitedEvidenceRe-review

Auth bypass · /api/sessionyesvideo✓

IDOR · /api/payouts/:idyesvideo✓

Verbose error · /healthno——

Rate limit · /api/logintesting…——

Works with

Proof that carries through to the fix

Exploit · auth bypass
→ request/response captured
→ re-reviewed · reproduced

Exploit Validation

Proof, not guesses, before a pentest finding reaches a human.

Triage queue

✓ Auth bypass · ranked first

Verbose error · not paged

Triage & Remediation

Prioritize by reachability and impact, then ship merge-ready fixes.

FAQ

Questions teams ask about the pentest agent

Pentests docs · Supported targets · Bug Hunts docs · Exploit Validation

Does the pentest agent test our whole web application, including the frontend?

+

No — a Pentest engagement targets REST and GraphQL APIs only. Single-page applications and server-rendered apps aren't attacked directly by Pentest; that surface is covered by Bug Hunts, which continuously monitor your external attack surface and can promote a discovered application into a Pentest engagement. If your production APIs are the priority, Pentest is the right tool; broader external surface coverage comes from Bug Hunts.

How is this different from an annual pentest we already buy?

+

A traditional pentest is a snapshot — good for the day it's delivered and stale the day after. Nullify's pentest agent runs continuously and hands-off, so validated findings surface as your APIs change instead of showing up in a report six months later.

How do we know a finding is real and not a false positive?

+

Because the agent doesn't report theoretical risk — it exploits. Every vulnerability is validated through actual multi-stage exploitation, and every successful exploit is independently re-reviewed against its own recorded evidence before it's reported to you.

What evidence do we actually get for a finding?

+

Each validated finding ships with the request/response pairs from the exploitation, screenshots, and video of the attack — enough to reproduce and verify the issue without re-running the engagement yourselves.

How do we launch an engagement?

+

From wherever fits your workflow: the Nullify console, the CLI, or the Pentester GitHub Action.

Scoped honestly

Pentests cover your APIs, and Bug Hunts cover the rest

The pentest agent attacks REST and GraphQL APIs. Single-page and server-rendered apps aren't attacked directly; Bug Hunts monitor that surface and can promote a discovered app into a pentest.

Get a Demo Read the Docs