zero-lab-ai

Analyzes and prioritizes Active Directory and BloodHound attack paths using evidence freshness, disabled principals, prerequisites...

Audits Active Directory Certificate Services configuration for dangerous certificate templates, PKI ACLs, enrollment interfaces, m...

Grades evidence for an AI agent's downstream actions without overstating what a callback, tool trace, file read, command result, o...

Plans and evaluates bounded runtime tests of AI agents, tools, memory, hooks, approvals, and scope enforcement. Use when static re...

Reviews an MCP server's tool surface for tool poisoning, over-broad parameters, missing descriptions, and privilege escalation pat...

Maps identity, authority, instruction, data, memory, and approval propagation across agents and agent-to-agent handoffs. Use when ...

Maps an authorized AI system's externally observable models, retrieval paths, agent tools, guardrails, endpoints, and privileged c...

Builds an evidence-bound AI threat model from partial architecture, trust, identity, data-flow, and control information. Use when ...

Validates supplied immutable ordered manifests of opaque defensive assessment actions for authority, safeguards, evidence, and sep...

Triages supplied binary, crash, sanitizer, dump, static-analysis, and external reproduction evidence to distinguish a lead, observ...

Governs an exact current binary-fault-triage assessment result and recorded validation-readiness handoff for separate isolated-lab...

Maps cloud identity and authorization paths across AWS, Azure, GCP, and hybrid trust boundaries, separating proven access from pla...

Assesses supplied defensive evidence for prevention, visibility, detection, containment, and recovery coverage against opaque comm...

Assesses covert-channel and data-egress exposure, then plans or records bounded purple-team validation with synthetic data. Use wh...

Audits supplied evidence when passwords, hashes, private keys, browser or vault entries, cloud CLI credentials, application secret...

Audits dataset sources, labels, transformations, review, versioning, split integrity, retraining triggers, and rollback controls f...

Synthesizes supplied evidence-backed defensive assessment results and administrative receipts into a scope-bound control-evidence ...

Builds detection rules that are proven before they ship — fire on known-bad, stay silent on known-good — and keeps false positives...

Plans and records bounded defensive tests of whether preventive controls, telemetry, and detections remain effective across pre-ap...

Runs attacker techniques and confirms whether detections actually fire, producing an honest ATT&CK coverage map that separates rea...

Audits supplied sanitized directory-service governance evidence for durable control and persistence exposure without contacting li...

Assembles supplied validated artifacts, immutable final findings, scope, methods, coverage, limitations, contradictions, and evide...

Reviews a supplied security artifact and reports supported findings. Use when an authorized assessment needs focused domain guidan...

Writes security findings that survive triage: reproducible, severity-justified, and fixable, in a fixed structure with a severity ...

Tracks embedded-device and firmware assessment coverage across exact units, acquisition methods, debug interfaces, stored secrets,...

Correlates supplied sanitized incident observations with separately approved isolated defensive-validation receipts across prevent...

Audits supplied sanitized Kerberos governance evidence for policy, protection, monitoring, and evidence-handling exposure without ...

Maps lateral movement candidates and multi-hop routes across Windows, Linux, network, DevOps, and cloud environments while separat...

Reviews an already-supplied lateral movement candidate for exact upstream map binding, authorization, non-production isolation, co...

Triages supplied Windows, Linux, or other volatile-memory images while preserving acquisition provenance, image integrity, process...