Docs

From signup to your first vulnerability report in five minutes.

Why we count tracked hosts, not discovered hosts, and how to swap them.

What the agent does, what it costs, how to set ceilings.

Deterministic default-credential checks run on demand (no Check spent, and the same result every time).

Step-by-step run timeline with the exact requests and responses; share via password-gated public link.

The two counted units, what each one covers, what is never counted, and where to see your remaining allowance.

A named AI persona that explains findings, suggests next steps, and answers why-does-this-matter questions without sending you to a search engine.

Recurring the port scanner port-scans across your entire target surface, on operator-tunable cadence.

Status, headers, body, title, favicon hash, TLS cert chain, banner (for every open port).

Every probed service gets product, version, vendor, category, and CPE, driven by curated rules and technology detection.

Per-host OS attribution voted from every service-level fingerprint we've collected.

Country, region, city, ASN, AS-org for every IP (free, offline, on every scan).

Group targets by business unit, acquisition, or product. Filter findings per-tenant; share scoped reports.

Paste 10,000 targets at once. Attach per-target exclude lists honoured by both scanner and ignore rules.

Tag every target with owner, criticality, data classification, and vendor. Risk-ranking finally reflects what hurts the business, not raw CVSS.

Every fingerprinted service gets matched against NVD + curated advisory feeds + curated intel; CISA KEV listings surface first.

Click 'Verify' on any CVE. The AI agent runs the exploit chain end-to-end and writes a one-page PoC.

End-to-end paid web application audit. The scanner sweeps the app, AI triages every finding, AI hunts for what scanners miss (IDOR, OAuth bypass, business logic). One Audit per scan, up to ten related backends included, capped AI cost, no surprise bills.

Read-only across AWS, Google Cloud & Azure. Umbra finds the exposure a port scan can't see (world-readable data proven with an anonymous read, identities that can escalate to admin, secrets in config, internet-open services) and the attack paths that chain them to your data. Every finding ships with the exact command that fixes it.

Umbra chains cloud findings into data-terminating attack paths (an internet-reachable workload → the identity it runs as → the specific data it can read) and proves public storage by fetching it with no credentials.

Every cloud finding ships with its concrete, resource-specific fix: the exact aws / gcloud / az command that removes the exposure, built from the finding's own evidence, with a guardrail to check before you apply it.

Export any cloud scan to a branded PDF (cover page, posture summary, per-finding detail with the exact remediation inline, and sign-off), the same report template as the internal-pentest and web-audit exports.

Triager probes ambiguous scanner findings live against the target instead of pattern-matching to false-positive guards. Confirms what's real, drops what's noise.

Reads the scanner's recon model and proposes the endpoints + vuln classes most likely to harbour real bugs. Narrows the search before any probe fires.

Ten scripted scenarios for the classes static rules can't reach (IDOR, OAuth bypass, JWT confusion, GraphQL abuse, mass assignment, price manipulation, role tampering, workflow bypass, multi-step ATO, cross-tenant UUID).

Opus-grade open exploration on the full recon bundle (clustered endpoints + JS-derived URLs + discovered params). Hunts for what the scripted scenarios missed.

Module-by-module progress for an in-flight audit (recon iterations, crawl complete, JS endpoint discovery, fuzzbox phases, every scanner module's start + complete).

Findings the AI couldn't judge with high confidence land in a per-scan review queue with the original scanner payload and the AI's error reason: review, accept, or replay.

When a scan hits its time or AI budget mid-run, the report renders with a clear partial-coverage badge. You see what was covered and what wasn't, no silent drop-offs.

5 MB Go binary. Linux amd64/arm64, macOS Apple Silicon, Windows amd64. Outbound HTTPS only.

Schedule internal CIDR scans on a cadence; optionally restrict to a maintenance window; auto-reprobe when services flip to gone.

The cloud AI routes every internal-target HTTP request through the agent. RFC1918 web apps + admin panels become first-class for exploit validation. For non-HTTP protocols (Postgres / MySQL / Redis / Mongo / SSH), see the companion TCP relay.

Same relay as the HTTP leg, raw bytes. AI sends Postgres / MySQL / Redis / MongoDB / SSH wire-protocol packets through the agent into the customer network. Auth-method discovery, banner grabs, default-credential testing on internal databases, not just HTTP services.

Defence in depth above the cloud-side scope check. Heartbeat-pushed CIDR list, locally enforced; refuses out-of-scope tasks without a single socket touched.

sha256 + ed25519 verification before swap; auto-rollback if the new binary doesn't heartbeat within 5 minutes.

Every task ships a timestamped log buffer back to the dashboard. Click 'Logs' on a task row to read it inline.

Loopback /healthz, --uninstall, HTTPS proxy support, --pinned-version override, JSON config file.

One-line --install registers the agent as a system service that persists across reboots, survives SSH disconnects, and exposes a clean --disable / --enable / --status / --uninstall lifecycle. Linux + macOS + Windows.

One click. A whole catalog of techniques fires against every live service the agent has discovered. Three safety tiers, one rollup view, every finding tagged by the technique that produced it.

BloodHound-style principals + edges, populated automatically by AD reconnaissance techniques. See who is admin to what, who is a member of which group, and which ACL edges enable escalation.

Every AI-verified finding across the surface, filterable by severity, kind, company, agent, internal-vs-external.

Stateful findings with status, assignee, due date, history: the operating system for a remediation program.

One page per target: every host, every service, every verified finding, ready to hand off.

Executive-grade summary (counts, trends, KEV exposure, compromised-host index, print-ready).

Every state change in the org: filterable by time window, type, or scope.

Org-level, board-ready PDF: posture KPIs, opened-vs-closed trend, top remediations, top open risks. Print → Save as PDF.

"What to fix this week": KPI tiles, top-10 priority issues, MTTR, all on one card above the findings list.

One email a week with the workspace's posture (critical / high open, fixed-this-week, MTTR, top 5 open risks). Same data as the executive dashboard, delivered to the inbox.

Map Umbra's data to specific SOC 2, ISO 27001, NIS2, and GDPR Article 32 control IDs and hand the artifact to your auditor (no spreadsheet reconciliation).

Mint a password-gated public link to a redacted compliance evidence pack. Hand it to your customer's security team instead of writing a questionnaire response.

OAuth-bound Slack app with five slash commands for investigation, exploitation, and reporting, without opening the dashboard.

Slack webhooks, email digests. Per-channel severity filters; suppression rules for the noisy categories.

One click creates the three notification rules every workspace wants on day one, no manual rule-engine learning curve.

One-click tickets to Jira, Linear, or GitHub from any finding. PoC + reproduction steps pre-filled.

Jira and GitHub Issues: close the ticket, the finding closes. Close the finding, the ticket transitions. Custom status maps per workspace.

Stream every Umbra finding into Splunk HEC or Microsoft Sentinel: one event per finding, correlated against the rest of your SecOps feeds.

Bearer-token authenticated read API for B2B partners + integrators. Pull findings, targets, host inventory, and deep audit reports as JSON.

20+ token-based filters across services, hosts, findings, targets. The same grammar everywhere: typed once, learned forever.

Type "critical CVEs on internal apache". Claude Haiku translates to the tokenised query in under a second.

Every major view has a right-side help drawer with token documentation and click-to-run examples.

Per-org isolation. Google + Microsoft OIDC sign-in. Email invites with role pre-selection.

viewer / member / admin / owner, plus per-user module access. Every privileged action logged with actor, timestamp, and scope.

Org-scoped audit-trail UI, every privileged action, filterable by action / actor / date, with a CSV export for SOC2 / ISO27001 auditors.

Paddle-backed checkout. Subscribe, upgrade, and manage your plan from workspace settings.

Two layers of module gating: per-org bundle entitlement (what the plan sells) and per-user module grants (an org-admin restricts a teammate to specific modules). Allow-by-default, dependency-closed, server-enforced, fails closed.