Prove what’s exploitable. Across every asset.
Corvex-RedOps is one engine for the whole assessment. It maps the attack surface, tests it, safely validates what’s real, ranks findings by exploit pressure and writes the client-ready report — across web, API, mobile, desktop, infrastructure and Active Directory.
git clone https://github.com/sajid-infosec/Corvex-RedOps && cd Corvex-RedOps && ./install.sh
- HighBroken object-level access · orders APIValidated
- HighKerberoastable service account · corpValidated
- MediumExported activity · Acme Mobile 3.2Manual
- LowMissing HSTS header · portalDetection only
- Licence
- Apache-2.0Community edition, free forever
- Deployment
- Self-hostedOnline or fully air-gapped
- Runs on
- Linux · macOS · WindowsDocker or native install
- Every finding
- Carries a validation stateAnd the evidence behind it
Scanners guess. Corvex-RedOps proves.
Most assessments drown in unconfirmed findings, need a different tool for every asset and end in days of report writing. Corvex-RedOps removes all three.
- 01Noise
Findings nobody trusts
Unconfirmed results waste triage time and wear down the relationship with engineering.
Every finding carries a validation state and the evidence behind it. - 02Tool sprawl
A tool for every asset
Web, API, mobile, Active Directory and config audits usually mean separate tools and separate exports.
One engine, one findings model, one report. - 03Report grind
Days lost to copy-paste
Engagements end with evidence pasted by hand into a template — then again for the retest.
Technical and executive reports in minutes, with retest diffs.
One loop, from scope to retest
Map the attack surface
Crawl web apps, including single-page apps; read OpenAPI specs; expand a root domain from certificate-transparency logs and passive sources; and import proxy or HAR captures into one asset inventory.
How it worksTest every asset type
Asset modules and engines run from one scope file, with one-click templates. Scope guardrails, time windows and per-host rate limits are enforced in code, and every action is written to an append-only audit log.
See coverageConfirm safely, with evidence
Safe validators re-test findings with non-destructive probes and a self-hosted out-of-band callback server. Each finding gets a validation state, so nobody has to argue about whether it is real.
See the evidenceRank by exploit pressure
One priority score combines CVSS, EPSS, CISA KEV, exploit maturity, validation state and confidence. Every factor is shown, and it all works offline.
How scoring worksClient-ready in minutes
Generate the technical report and the executive summary in HTML, PDF, DOCX or Markdown, with OWASP, PCI DSS, ISO 27001 and MITRE ATT&CK mapping and an exploitability and validation coverage section.
See the reportProve the fix
Retests compare against the previous run and mark every finding new, persisting or fixed. Validated findings open tickets in Jira or ServiceNow, with SLA and time-to-remediate tracking.
Get startedProof you can see, not a percentage you have to trust.
Every validated finding ships with the evidence that proved it, redacted and attached to the report. Validation probes are non-destructive by design.
- Safe-confirmed
Proved with a non-destructive probe.
- Active
Confirmable with an opt-in check you approve.
- Manual
Flagged for an operator to confirm.
- Detection only
Found, and clearly labelled unconfirmed.
Every asset, one engine.
Asset modules and engines share one findings model, so a web bug, a weak AD delegation and a leaky APK land in the same prioritised report. Rows marked PREMIUM need a paid edition.
Ranked by exploit pressure
One priority score combines six signals and shows every factor, so the first fix is the one most likely to be used against you. It works offline.
Client-ready in minutes
The technical report and the executive summary come from the same run, with compliance mapping and an exploitability and validation coverage section.
The people who sign the report.
Deliver more engagements with less report work
Run scope, testing, validation and reporting from one engine, then send a white-label report the same day.
- Scope guardrails, time windows and an audit log for every action
- White-label technical and executive reports
- Retest diffs that show exactly what was fixed
Continuous assessment across a mixed estate
Schedule scans across web, API, cloud, Active Directory and config, and send only validated findings to engineering.
- Scheduled scans and exposure alerts
- Jira and ServiceNow tickets for validated findings
- SLA and time-to-remediate tracking
Run every client from one platform
A separate workspace per client, a client portal and white-label reports at scale.
- Workspace per client with role-based access
- Client portal for findings and retests
- Your brand on every report
Assess sensitive estates without data leaving
Install on-premises or fully air-gapped. A local model drafts reports without any cloud call.
- Air-gapped install with local AI
- Evidence and client data stay on your network
- Mapping to OWASP, PCI DSS, ISO 27001 and ATT&CK
Free to start. Priced per operator, not per asset.
Community covers the application layer, free forever under Apache-2.0. Premium adds the enterprise engines, scheduling, white-label reports and teams.
Read the code. Run it yourself.
Every check, validator and report template lives in a public repository you can audit before you point it at a client.
Built on GitHub, in public
Read the code, follow releases, open issues and contribute checks. The Community edition is Apache-2.0 and never expires.
Free labs beyond the browser
Topics and downloadable labs for web, API, infrastructure, Active Directory, mobile and config — the domains most training skips.
Questions go to the people who write the checks
Report a false positive, request a check or ask how a validator works in the project’s issue tracker.
Your evidence never leaves your network.
Every trust claim below links to the document or code that backs it.