Meet Constantine – Find Mythos-level vulnerabilities in your code. It proves them, patches them, PRs them back. Autonomously.

Download Datasheet
Praetorian Guard / Continuous Penetration Testing

Continuous Penetration Testing

A target and an objective. Everything else is a dial.

Testing that runs on your cadence, not your auditor’s.

Marcus, Guard’s orchestrator, plans the engagement and delegates to specialists: credential attacks, web application, cloud, secrets and supply chain, LLM interfaces. Each sub-agent receives only the tool calls its specialization needs. That boundary is enforced in code, not in a prompt. Narrow scope is also why the work holds up. A specialist with five tools makes fewer mistakes than a generalist with fifty.

Start with one domain
See the Guard platform
GUARD · SESSION · MARCUS

What is continuous penetration testing?

Continuous penetration testing runs offensive security testing on an ongoing cadence instead of as a once-a-year engagement, so new exposures are tested as the environment changes.
In Praetorian Guard, an orchestrator agent plans each engagement and delegates to specialist agents for credential attacks, web applications, cloud, secrets and supply chain, and LLM interfaces. Human operators review what the agents surface.
Set the cadence: weekly against the perimeter, authenticated every two weeks, cloud nightly. Human operators review what the agents surface.
The annual assessment still comes with the subscription, time-boxed to the dates you pick. You’re not trading it away for continuous coverage. You’re getting the other fifty-one weeks.
Decide how much rope
IN THE LOOP
Task Marcus in chat, Slack or Teams
ON THE LOOP
Zoom into any agent mid-operation
OFF THE LOOP
Set budget and exit criteria, walk away
The program

Offense that runs like a program, not an event.

Guard moves through the year in phases rather than showing up once. Spend most of it overt, so your loop is faster than the attacker’s.
Penetration TestingOVERTPenetration TestingOVERTAnnual Penetration TestCOMPLIANCECOLLABORATIVEPurple TeamCOLLABORATIVEPurple TeamCOVERTRed TeamCOVERTRed TeamCOVERTRed TeamCOVERTRed Team
OVERT
Continuous agentic penetration testing across every surface, with your systems of record in play so the agents inherit the terrain instead of rediscovering it
PURPLE
Re-detonate the chains Guard actually proved while it watches your EDR telemetry, then get a gap analysis against MITRE ATT&CK® of the techniques you saw and missed
COVERT
Once detection and response can take it, the red team phase: phishing, command and control, payload generation, EDR bypass. Then the cycle repeats.
Rules of engagement
SCOPED BEFORE EXECUTION
Authorized targets and exclusions are set before the first tool call
ENFORCED IN CODE
Tool boundaries are structural, not instructions an agent can talk itself out of
FULLY LOGGED
Every call, every result, every hop, exportable
Pen testing vs. point products

Point products are inputs. Guard is the outcome.

Every category below is something an operator needs on the way to an answer. None of them is the answer. Guard runs them as modules, or ingests the ones you already own, and uses them to find where you actually get compromised.
The line item
What it gives you today
What Guard does with it
Annual penetration test
A compliance artifact treated as the program
It comes with the subscription, time boxed to the dates you choose, with a year of real risk reduction behind it.
USE OURS
Guard ships every one of these capabilities itself. Consolidate the stack and cancel what it makes redundant.
OR BRING YOUR OWN
Keep the tools you have renewed and plug them in through over 80 integrations. Guard does not care where an input comes from, only whether it survives proof.
Operator-validated pen testing

Agents run the operation. Operators own the result.

Praetorian has been running offensive engagements for over a decade. Guard is that tradecraft written into code, and the same operators still review what comes out of it. An exploited finding gets operator review before it reaches you. When something needs a signature for a board, an auditor, or a customer security review, a Praetorian operator signs it.
Guard interrogates the environment for what actually is, mapped to NIST CSF and FDA today, with ISO 27001 and PCI coming.
OPERATOR REVIEW
Exploited findings are reviewed by the people who wrote the tradecraft
NAMED ATTESTATION
A human signs what your auditor and your board receive
ANNUAL ASSESSMENT INCLUDED
Human-led, on your dates, inside the same subscription
Related Guard capabilities

The rest of the platform

Attack Surface Management

Start with a domain. See what an adversary would find.

Explore attack surface management →
Vulnerability Management

A finding is a claim until something exploits it.

Explore vulnerability management →
Breach and Attack Simulation

Did anything catch it?

Explore breach and attack simulation →
Threat Intelligence

A CVE drops. Guard already knows if it touches you.

Explore threat intelligence →
Continuous Threat Exposure Management

Exposure management that proves what is exploitable.

Explore CTEM →
FAQ

Continuous penetration testing questions

Continuous penetration testing runs offensive security testing on an ongoing cadence instead of as a once-a-year engagement, so new exposures are tested as the environment changes.

You set the cadence, for example weekly against the perimeter, authenticated testing every two weeks, and cloud nightly.

No. The annual assessment is included with the subscription, time-boxed to the dates you pick.

You choose the level of involvement: task the orchestrator in chat, Slack, or Teams, zoom into any agent mid-operation, or set a budget and exit criteria and let it run.

Authorized targets and exclusions are set before the first tool call, tool boundaries are enforced in code, and every call, result, and hop is logged and exportable.

Start on Guard Free with a single domain and no integration work, or request a month-long free pilot run against your own environment.

Pilots and free access

If the point of your program is to keep people like us out, get our perspective on it.

Month-long free pilots, funded with AI tokens, run against your own environment. See what a fleet of offensive agents finds before someone less friendly does. Or start on Guard Free with a single domain and no integration work.
Start with one domain
Start a pilot
Or watch the 42-minute walkthrough
Get started

Get started with Guard

Watch Guard work a real attack surface end to end: discovery, validation, and exploitation, with the operators who run it. Then point it at one of your own domains for free.