Nexich
Self-hosted network red teaming

Breach it
before they do.

The full attack chain: recon to proven exploit. Autonomous. Air-gapped. One binary.

Request access
  • No cloud
  • Zero telemetry
  • Windows · Linux · macOS
Prove it, without leaving your network. Autonomous proof, zero exfiltration. The AI, the exploit and every finding stay on your metal.
Why now

Three ways teams find out too late.

Every existing option leaves a gap an attacker walks straight through.

Manual pentest

A photo of a moving target

A point-in-time report that's stale the week it lands, and gated by how many hours a human could spend.

Nexich runs continuously, on demand, at machine scale.
Cloud autonomous tools

Your topology, on someone else's servers

SaaS pentest tools ship your network map, credentials and findings off-site to run. That's the exact data you're protecting.

Nexich runs entirely inside your perimeter. Nothing egresses.
Vulnerability scanners

A list of maybes

Scanners flag versions and CVEs but never pull the trigger. You're left triaging thousands of unproven "criticals."

Nexich chains and detonates them. Proof or it isn't recorded.
Sovereignty by design

The one thing no cloud tool can offer.

The AI and everything it runs live on your hardware. This is the moat.

One binary

The whole product, one file. No agents, no cloud, no dependencies.

AI that stays inside

Local models, zero internet. The AI never sees a live credential.

Runs anywhere, safely

Every payload is proven in isolation, on any host, without touching production.

How it works

Recon to proof, one unbroken chain.

One tool, one continuous workflow from recon to proof, and it re-verifies the fix.

1
Discover

Map everything

2
Prioritize

AI triage

3
Exploit

Detonate

4
Prove

Capture proof

5
Re-test

Verify the fix

See each stage in depth
Universal attack surface

Every service on the wire.

200+ native attack modules across every service class an attacker touches: web, identity, databases, message queues, remote access, file shares, VoIP, OT and IoT. Most tools stop at web apps and Active Directory. Nexich carries the whole estate.

Web & APIs

apps, REST and GraphQL, auth, injection

Identity & AD

Kerberos, credential replay, domain takeover

Databases

SQL and NoSQL, dumps, RCE via the DB

Messaging & MQ

queues, brokers, MQTT, CI/CD

Remote access

RDP, VNC, SSH, telnet

File shares

SMB and NFS, deep-walk looting

VoIP & telephony

SIP and PBX, call infrastructure

OT / ICS / SCADA

PLCs, HMIs, industrial protocols

IoT & smart building

cameras, sensors, building automation

Network infra

routers, switches, printers, LLMNR

One foothold in IT can end in operational or physical impact on the OT floor. That is the whole estate, IT to OT, proven in a single chain.

Shown, not claimed

We don't flag risk. We prove it.

Every critical carries its own reproducible evidence: the kill chain, the captured command, the verified re-test.

nexich · operations center · 10.0.0.0/24 live
Nexich Operations Center: live KPIs (hosts at risk, critical findings, captured sessions, open ports), a verified-findings board, risk posture, and an AI-authored executive summary.
Cross-host kill chain
web-01 · 10.0.0.12foothold
└─ looted db creds ▼
db-02 · 10.0.0.31DB dump
└─ reused admin hash ▼
dc-01 · 10.0.0.5domain admin

Looted credentials replay across hosts: A → B → C, each hop reproduced and scored.

Captured command output
postgres@db-02:~$ COPY (SELECT '') TO PROGRAM 'id'
uid=0(root) gid=0(root) groups=0(root)
postgres@db-02:~$ cat /etc/shadow | head -1
root:$6$xE9...:19722:0:99999:7:::
✓ shell reproduced · evidence stored

Not a version guess: the real command, the real output, captured safely in isolation.

Re-test & verify
FindingPostgres weak creds → RCE
First runproven
Re-testedfixed

AI verdict: credential rotated and TO PROGRAM revoked from the login role. Exploit no longer reproduces.

Re-fire any finding on demand. The AI confirms the fix, or tells you why it still breaks.

The Attack Graph

The kill chain, reconstructed and proven.

Every node is an owned host, every edge a real causal link, from foothold to crown jewel.

nexich · operation aurora · attack story proven
Nexich Attack Graph: two proven kill chains from unauthenticated footholds, an exposed Jenkins console on 10.0.0.23 and a GitLab account-takeover on 10.0.0.18, pivoting through looted credentials to two crown jewels, a customer database and Domain Admin, every step marked proven.
Two proven kill chains from unauthenticated Jenkins and GitLab footholds to two crown jewels, the customer database and the domain. Computed from reproduced evidence, not drawn by hand.
Autonomy ladder

Five modes. One dial of AI.

From a hands-on classic operation to full autonomous 0-day hunting. Turn the dial.

AI autonomy
Full

AI Forge

Full-scope autonomous 0-day hunting. The AI owns discovery to proven exploit: every service, every credential, chained.

Continuous 0-day hunting on custom apps & dev servers

Where it fits

Not a scanner. Not a cloud. Not point-in-time.

The short version. The full breakdown lives on the comparison page.

Capability Nexich Manual pentest Vuln scanner Cloud autonomous
Proves exploitability (not just detects)✓✓✕✓
Runs fully air-gapped / offline✓~~✕
AI runs on your hardware✓✕✕✕
Nothing leaves your network✓~~✕
Continuous / on-demand✓✕✓✓
One self-contained binary, nothing to install✓✕✕✕
✓ full ~ partial / depends ✕ no
See the full comparison
Who runs it

One platform. Four jobs to be done.

Red team

Offensive operators

A force multiplier that runs the tedious chain end-to-end so you focus on the novel path.

Full-scope 0-day hunting, chained & proven.

CISO / security lead

Program owners

Continuous validation of what's actually exploitable, not a scanner's backlog of maybes.

Proof to prioritize, evidence to defend spend.

MSSP

Service providers

Run authorized engagements across many client networks from one self-hosted platform.

Repeatable, on-prem, per-engagement.

Compliance / audit

GRC teams

Map proven findings to frameworks and reuse the evidence. No data ever leaves the estate.

Framework-mapped, air-gapped evidence.
0native attack modules
0ports swept · TCP + UDP
0compliance frameworks
0bytes sent off-box
Trust & sovereignty

The one place your attack data stays put.

Nexich is software you run inside the network you're testing. No telemetry, no phone-home, no third-party fingerprints on the wire. Verifiable by design.

How we prove it
Zero telemetryNo usage data, no metrics, no callbacks, ever.
No egressTopology, creds and findings never leave your perimeter.
Local modelsThe AI runs on your hardware; never sees a live credential.
Authorized use onlyBuilt for owners of the network under test.
Questions

The things buyers ask first.

Is it safe to run against production?
Yes, with control. Exploits are proven safely in isolation, never against the host, and Nexich automatically backs off if a target service shows stress. Classic mode is fully deterministic and hands-on, so you choose how far the dial turns.
Does the AI phone home or send data anywhere?
No. Models run locally on your hardware with zero internet, the AI never sees a live credential, and there is no telemetry. Nothing (not a hash, not a topology, not a finding) is sent off-box. See the trust page.
How is this different from a vulnerability scanner?
A scanner flags versions and CVEs. Nexich chains and detonates them into a proven exploit (a shell, a dumped database, a cross-host kill chain) with reproducible evidence. If it can't be proven, it isn't recorded. Full comparison.
Won't an autonomous AI hallucinate false positives?
Exploitation is deterministic execution, not generative guesswork. The AI plans, but a finding is only kept when a real payload reproduces it. Every finding carries its own proof; unproven claims are dropped. How it works.
What does deployment look like?
One binary, with the AI included. No agents, no cloud services, no external dependencies. Runs on Windows, Linux and macOS, including fully air-gapped networks.
Read the full FAQ

Run the whole attack chain.
On your own metal.

Request an authorized evaluation

A supervised eval build for the owners of the network under test.

Evaluation builds for authorized testing only.