Pentest everything.Continuously.

As part of our research program, PurpleSwarm conducts non-intrusive passive scans across the public internet to identify exposed assets and potential vulnerabilities. We don't attempt exploitation. When we identify a significant exposure, we contact the registered owner of the affected asset directly through responsible disclosure channels, giving them the information they need to fix the issue before others find it.

Recent independent evaluations, including published assessments from national AI safety institutes, have confirmed that the latest generation of high-reasoning AI models can materially accelerate vulnerability discovery and exploitation chain construction. PurpleSwarm is designed to give defenders equivalent capability.

Yes. Aggression levels are configurable, from fully passive surface mapping through to authorized adversarial simulation. All agent activity is logged with full attribution, so there's no ambiguity between PurpleSwarm activity and genuine attacker traffic. Safety constraints are enforced at the platform level, not left to individual configuration.

No. The platform is designed to be operated by engineering teams without specialist security knowledge. Reports use plain language with clear remediation guidance. Security professionals will find detailed artifacts like CVSS scores, MITRE ATT&CK mappings, and raw agent logs available for deeper investigation when needed.

Installing the GitHub or GitLab application is sufficient. From that point, every pull request triggers a dedicated analysis agent that evaluates the code diff in the context of your current attack surface. Findings are surfaced as inline comments. Critical issues can be configured to block merges pending remediation.

Yes. We routinely work under mutual non-disclosure agreements, particularly with organizations in regulated industries or those undergoing managed penetration testing engagements. Just tell us after we respond to your access request, and we'll coordinate directly before any assessment begins.

All data, including scan results, findings, and account information, is stored exclusively within the European Union. We don't transfer assessment data outside the EU. Our infrastructure is hosted on EU-region cloud providers and complies with GDPR data residency requirements.

Yes. You can request full deletion of all data associated with your account and assessments at any time. Upon receiving a verified deletion request, all findings, scan artifacts, and account records are permanently removed from our systems within 30 days. We'll confirm completion in writing.