Your scanner says you're patched. We prove whether you actually are.
AetherCipher runs 500+ behavioral tests against your infrastructure. Not version checks — actual protocol-level probes that determine whether each vulnerability is real, patched, or falsely reported. Audit-grade evidence. Zero false positives.
Here's what we found on a production server in 47 minutes
This is an anonymized excerpt from an actual assessment. The target ran OpenSSH 7.4, nginx, and MySQL on a CentOS 7 host. A traditional scanner reported 286 CVEs. We determined which ones actually matter.
red_queen — scan results
[Scan]Target: ███.███.██.199 — OpenSSH 7.4 / nginx 1.25.4 / MySQL 8.0.35 [Scan] Precision probes: 348 executed across 5 services [Scan] Learning engine: 50,209 observations in baseline
[Results]VULNERABLE — 12 AI-TRIVIAL (exploitable by automated tools today) [Results]VULNERABLE — 21 AI-ASSISTED (exploitable with moderate skill) [Results]LIKELY PATCHED — 39 (behavioral test confirms remediation) [Results]NOT APPLICABLE — 18 (CVE does not affect this configuration)
[Anomaly]CONFIRMED TIMING ANOMALY — CVE-2016-20012 on SSH port 22 [Anomaly] Probe response: 1,582ms (6.1σ above 712ms baseline) [Anomaly] Auto-retry: 2/3 confirmed — not network jitter
[Report] Executive summary sealed: SHA-256 a4f8c2e1... [Report] Attack plan generated: 7 phases, 4-hour estimated time to full compromise [Seal]Verification OK: no discrepancies.
500+CVE-Specific Behavioral Tests
128Protocol-Level Probe Functions
30+Service Families Covered
0False Positives in Last 50 Scans
The Difference
Version matching vs. behavioral evidence
Traditional scanners check version numbers. If MySQL reports 8.0.27 and the CVE says "fixed in 8.0.27," they mark it green. But patches fail silently. Configurations conflict. Backports break version logic. We test the actual behavior.
✕ Traditional Scanner
✕Reports 286 CVEs — which ones are real?
✕Version says "patched" — but was the service restarted?
✕Can't detect deprecated algorithms or protocol compliance issues
✕Same results every scan — no learning, no baselines
✓Hash-sealed evidence chain for every finding — audit-grade, compliance-ready
Three-Tier Verification
How we eliminate false positives
Every finding passes through three independent verification layers. Behavioral evidence overrides version checks. Contradictions are surfaced, not hidden.
01 — DISCOVER
Service Fingerprinting
Nmap identifies services and versions. Soft probes extract SSH algorithm lists, TLS configurations, database capabilities, and protocol details that version strings alone can't reveal.
02 — VERIFY
Behavioral Probes
500+ CVE-specific precision probes test each vulnerability through actual protocol interaction. Request smuggling? We send the malformed headers. Weak crypto? We negotiate the deprecated algorithms. The server's response IS the evidence.
03 — LEARN
Anomaly Detection
The learning engine compares every response against 50,000+ historical observations. Timing deviations, behavioral drift, deprecated protocols, information leakage, and cross-target outliers are flagged automatically.
Living Detection Engine
Seven anomaly types that scanners can't detect
Beyond CVE matching, the Red Queen learning engine monitors every probe response for behavioral patterns that indicate zero-days, misconfigurations, or infrastructure changes.
CONFIRMED TIMING ANOMALY — 6.1σ deviationSSH probe took 1,582ms vs 712ms baseline. Auto-retried 3×, confirmed 2/3 anomalous. Server processes this specific request measurably slower than every other SSH server in baseline. Possible processing vulnerability.
PROTOCOL COMPLIANCE — 6 deprecated algorithmsSSH server offers diffie-hellman-group1-sha1 (Logjam-vulnerable), ssh-rsa (SHA-1 deprecated), 3des-cbc (Sweet32). Modern servers removed these. Weak cryptography protecting all SSH traffic.
CROSS-TARGET OUTLIER — 100% deviation from 30 targetsThis server exposes .git/ repository on HTTP. Zero of 30 other HTTP servers scanned show this pattern. Unique misconfiguration — source code, commit history, and potentially credentials downloadable.
INFORMATION LEAKAGE — debug endpoints exposed/server-status, /server-info, and /phpinfo.php accessible on port 3000. Internal architecture, request statistics, and PHP configuration exposed to any visitor.
Sample Report Excerpt
What your executive summary looks like
Every finding includes the evidence chain, AI exploitability classification, and recommended action. Hash-sealed and timestamped for audit compliance.
We don't just find vulnerabilities. We show the kill chain.
Every assessment includes a detailed attack narrative showing exactly how an attacker would progress from initial access to data exfiltration, with specific commands, timing estimates, and persistence techniques.
attack_plan — 7-phase narrative
## DETAILED ATTACK NARRATIVE
### Phase 1: RECONNAISSANCE[15 min]
Attacker discovers 5 open services. Version disclosed in banners.
232 potential CVEs identified. Narrows to highest-impact exploits.
### Phase 2: INITIAL ACCESS[10 min] Entry Point: CVE-2023-25690 (CRITICAL, CVSS 9.8)
Request smuggling via CL-TE desync on Apache 2.4.6.
Exploit availability: Metasploit module. Automated — no skill required.
### Phase 3: POST-EXPLOITATION[30 min]
Situational awareness → Credential harvesting → Web server config →
Database connections → Network discovery of internal services.
Total estimated time: first contact → data exfiltration: 4 hours
See what a real assessment looks like
We'll scan one of your external-facing hosts and deliver the full report — executive summary, technical findings, attack plan, anomaly analysis. You evaluate the quality. No commitment.
Your message is encrypted in transit and securely delivered to our inbox.