Internal & Active Directory
Kerberoasting, NTLM relay, BloodHound path analysis and lateral movement, chained from first foothold to Domain Admin.
KerberosNTLM relayBloodHoundDCSync
Explore Internal & Active Directory
340+ agents · Patent pending
Every attack path, proven.
Specialized AI agents attack your network, perimeter and apps around the clock. Every finding is safely exploited and proven.
PROOFOpen a real finding: NTLM relay → Domain Admin01 / The problem
Neither shows how far an attacker could actually get today, from a first foothold to Domain Admin and your most sensitive data. Canima runs the engagement continuously, chains findings into real attack paths, and only reports what it has proven.
02 / The portal
Everything the agents prove, in one portal.
Findings, attack chains, retests and reports from every engagement. These are real screens from a demo tenant.
One view across every engagement.
- 1Open findings by severity
- 2Report pipeline, draft to published
- 3Ageing against your SLA
Every row is confirmed, across all four surfaces.
- 1Status: Confirmed, never “possible”
- 2Internal, external, ASM and web in one queue
- 3Export to CSV or your tracker
Proof, context and the fix on one page.
- 1Linked to its attack chain
- 2Host-specific remediation
- 3Request retest, always free
Your perimeter, watched continuously.
- 1Dorks, phishing, breach, CVE, port and DNS monitors
- 2Severity across the perimeter
- 3Breaches and phishing domains
portal.canima.com · Dashboard
Real portal · demo tenant
01 / 04 · Select a view
03 / Coverage
Three attack surfaces. One engagement.
External & Attack Surface
Subdomain recon, exposed services and leaked-credential monitoring. New exposures are tested as they appear.
SubdomainsCVE resolverStealer logsOSINT
Explore External & Attack Surface
Web App & API
Business logic, authentication flows and API chains, tested per application with every role authenticated.
XSSSQLiSSRFJWT
Explore Web App & API
04 / How it works
Find. Prove. Report. Retest, free.
01 — Find
Agents enumerate and attack
Specialized agents map hosts, identities and apps, then attack in parallel through a shared knowledge graph.
02 — Prove
Safe exploitation, every time
Nothing is reported until it is exploited safely. Each finding carries proof-of-concept evidence.
03 — Report
Attack chains, not lists
Findings ship as end-to-end paths with CVSS, remediation guidance and compliance-ready reports.
04 — Retest
Retesting is always free
Fix it, click retest. Verification never consumes your limits or application slots.
05 / The Canima Difference
Built From a Hacker's Mindset
Canima was designed from the ground up by offensive security experts who think like attackers. This hacker-first approach ensures authentic attack replication and real-world threat modeling at scale.
01
Autonomous AI Agents That Understand Context
Hundreds of specialized AI agents trained on real-world breaches from hundreds of offensive engagements. Each agent understands your environment: how authentication flows work, where privilege boundaries exist, and which business logic could be exploited, spotting sophisticated threats automated scanners miss.
02
Self-Updating Intelligence + Validated Findings
Weekly updates from live CVE feeds, dark web data, and ongoing real-world offensive engagements. Every finding is automatically validated through safe exploitation, delivering only actionable, exploitable vulnerabilities with proof-of-concept evidence. 99.9% reduction in false positive triage.
03
Trained on Real Breaches, Not Vulnerability Lists
Built by Elias Marquez, founder of Achilleus penetration testing firm. Every attack chain, privilege escalation path, and lateral movement technique comes from hundreds of real-world engagements, not theoretical databases. This is adversarial thinking encoded at scale.
| Capability | Canima | Others |
|---|---|---|
| Autonomous exploitation chains | Yes | No |
| Human-like decision making | Yes | No |
| Context-aware attack paths | Yes | No |
| Real pentester methodology | Yes | No |
| Adaptive engagement logic | Yes | No |
| Expert escalation when needed | Yes | No |
06 / Agents at work
One agent per technique. 340+ of them.
The Kerberos agent thinks only about Kerberos. Active agents (cyan) are running on engagements right now.
Stream
tail -f /var/log/canima
Validated findingstoday
Sample engagement · acme-corp
Every finding validated by safe exploitation
The catalog
- web.agent XSS
- web.agent SQL Injection
- web.agent SSRF
- web.agent XXE
- web.agent CSRF
- web.agent JWT Auditor
- web.agent GraphQL
- web.agent WebSocket
- internal.agent Kerberos
- internal.agent NTLM Relay
- internal.agent BloodHound
- internal.agent SMB
- internal.agent LDAP
- internal.agent Pass-the-Hash
- external.agent Subdomain
- external.agent Nmap Planner
- external.agent VPN / IPsec
- external.agent OSINT
- external.agent GitHub Secrets
- asm.agent Cert Transparency
- asm.agent Dork Verifier
- asm.agent Stealer Logs
- asm.agent Lookalike Dom.
- asm.agent CVE Resolver
07 / Use cases
Who runs Canima.
Internal teams
Security & IT operations
Test continuously across internal and external networks without booking an outside firm.
Learn more MSP / MSSPManaged service providers
Multi-tenant, co-branded reports and complete data isolation between clients.
Learn more Pentest firmsAugment your testers
Let agents handle recon and initial exploitation so your people go deeper.
Learn more CompliancePCI DSS, SOC 2, ISO 27001, HIPAA
Evidence-backed reports auditors accept, refreshed every month.
Learn moreFounder
Canima encodes a decade of real engagement methodology. Every attack chain and escalation path comes from work on real networks, not theoretical models.
Elias Marquez
Founder, Canima · Founder, Achilleus (10+ years offensive security)
09 / Pricing
Priced by what you test.
Domains and IPs for network testing. Per application for web apps. Retesting is always free.
External pentest & ASM
Per root domain + live asset
From 2 domains and 10 assets. Monthly limits.
Internal network
Per live internal IP
From 100 IPs. No minimum asset count.
Web application
Per application, annual
12 assessments a year per app, unlimited retests.
10 / Questions buyers ask
Can one customer see another customer’s data?
No. The multi-tenant platform keeps complete data isolation between tenants, including for MSPs running many clients from one dashboard.
Does our data go to a third-party AI provider?
No. Canima runs proprietary models and calls no third-party AI APIs.
Is it safe to run against production?
Yes. Agents use safe exploitation techniques designed for production, and you can set risk tolerance per engagement.
How do you avoid false positives?
Every finding is validated by safe exploitation and delivered with proof-of-concept evidence. Edge cases escalate to human QA.
What does a retest cost?
Nothing. Retesting is free on every plan and never consumes limits or application slots.
Do I have to talk to sales to try it?
No. Explore the platform in a self-serve demo with sample data. SSO is included on every plan.
Explore the platform before you commit.
Autonomous penetration testing. Validated, continuous, real.