Capability
Attack surface analysis that stops at what an attacker can reach.
Vorthix AI's XOR-1 agent maps the entry points of complex software, follows untrusted data through it, and keeps the vulnerabilities an attacker can reach from outside. For network-facing bugs it builds a lab with an attacker and a target, and shows the outcome across a real connection.
- Scope
- Entry points to impact
- Remote bugs
- Attacker and target lab
- Languages
- 14 supported
The problem
Large systems hide their real exposure.
Modern software has thousands of functions, and only a fraction accepts input from outside. Without a map, triage treats every flagged line as equally urgent.
Teams lose weeks debating whether a bug is reachable instead of fixing the ones that are.
How XOR-1 works on this
From first hypothesis to a verified report.
- 01
Enumerate entry points
XOR-1 finds every place the software accepts input: network handlers, file parsers, APIs, and command interfaces.
- 02
Trace untrusted data
It follows that input through the code to the operations where it could do harm.
- 03
Build the lab
For network-facing issues the agent sets up an attacker server, a target server, and the payload between them.
- 04
Confirm reachability
A finding is kept only when the agent shows an outside party can trigger it.
What your team receives
A handoff engineers can act on.
- A map of entry points and data flows
- Findings ranked by attacker reachability
- A network-level demonstration for remote bugs
- Clear notes on what was and was not reached
- Verification by the Vorthix research team before delivery
Published work
Findings you can read in full.
Questions
Common questions.
What does attacker-reachable mean?
It means untrusted input from outside the system can actually reach the flawed code. XOR-1 confirms this instead of assuming it, so engineers spend time on bugs that can really be used.
Does testing touch our production systems?
No. Testing runs in isolated environments built from your code, unless a different arrangement is agreed in writing.
Which targets and languages are supported?
C, C++, Rust, Go, Python, TypeScript, JavaScript, Java, Kotlin, Ruby, PHP, Swift, Assembly, and Solidity, plus compiled binaries.
Can the attack surface map be used for planning?
Yes. The map of entry points and data flows is part of the handoff, and teams use it to prioritize hardening and reviews.
Keep exploring
More from Vorthix Sec.
Bring us the code that matters most.
Tell us about your software and we will scope the right engagement.