An API with new users.
The API serves new partners with permissions defined when the operation was smaller.
+SECURITY IN THE ERA OF AI-ASSISTED ATTACKS
Find whereyour business isexposed to attacks.
When even large companies suffer attacks, it can be hard to know where to start. RAYZ investigates your company’s systems and access to find weaknesses, understand what they allow and identify what needs fixing.
Free Recon: finding counts by severity, with no obligation to buy.
What connects to your business.
Accounts and work
- Google Workspace
- Microsoft 365 and access
- Gmail / Exchange
- Two-step authentication
- App permissions
- Email DNS
Cloud and infrastructure
- AWS
- Azure
- Google Cloud
- Docker
- Kubernetes
- TLS and certificates
Applications and APIs
- Websites and portals
- APIs
- OpenAPI / Swagger
- Postman
- JavaScript
- Android
- iOS · static analysis
- Test environments
- Lovable apps
- Bolt apps
- v0 apps
- Replit apps
Files and exposure
- Google Drive
- SharePoint
- OneDrive
- FTP / FTPS
- Buckets and storage
- Domains and subdomains
- Documents and metadata
Code and delivery
- Repositories
- GitHub Actions
- GitLab CI
- Dependencies
- Credentials in code
- Binaries and packages
Partners and integrations
- Partner tokens
- Webhooks
- Slack
- Telegram
- OpenTelemetry
- Metrics and diagnostics
Your businessRAYZ
01 / APPLICATION SECURITY AND ACCESS
Were access reviews postponed?
When a team prioritizes a launch, test environments and old permissions can go unchecked. We investigate these systems to find out whether they expose data or allow unauthorized access.
An open test environment.
The environment used for launch remains accessible from the internet.
A credential with too much access.
A token allows access to data the integration does not need.
Third-party risk
48%of breaches analyzed in the 2026 DBIR involved third parties.
Verizon · DBIR 2026Multiple surfaces affected
87%of intrusions investigated by Unit 42 involved more than one attack surface.
Unit 42 · 2026Credentials still active
64%of valid credentials from 2022 tracked by GitGuardian had still not been revoked in 2026.
GitGuardian · 2026Preventable gaps
>90%of incidents handled by Unit 42 in 2025 involved misconfigurations or security coverage gaps that helped enable the intrusion.
Unit 42 · 202602 / PROPRIETARY TECHNOLOGY
The exclusive RAYZ method.
We developed proprietary technology that combines analyses from different AI models under the direction of a specialist, who leads the investigation from surface mapping onward, decides which hypotheses to test and reviews the evidence throughout the work.
Discover the surface
We map the domains, applications and integrations associated with the authorized assets under a specialist’s direction, working with your team to confirm which systems belong to the operation and should be investigated.
Investigate access paths
The specialist directs tests of permissions and connections between systems to establish how far an access path can reach and what data it could expose.
Compare analyses and evidence
Our system compares analyses from different AI models while the specialist challenges the results and chooses the next checks based on the evidence and the investigation history.
Validate and prioritize findings
Before assigning severity to a finding, the specialist checks its demonstrated impact and prepares remediation guidance, separating what has been proven from hypotheses that still need confirmation.
03 / SERVICES
Choose what you need to test.
01EXTERNAL RECONNAISSANCE
Recon
FreeReceive a count of findings by severity after reconnaissance of the authorized assets.
- Reconnaissance of the authorized surface
- Finding counts by severity
- Confidential results
Finding details are included in paid plans. Recon comes with no obligation to buy.
Request free Recon02PENTEST
Ray-Z
Custom quoteInvestigation of a web application or API using the RAYZ method. You receive evidence of the findings and remediation recommendations.
- Testing within an agreed scope
- Evidence and impact for each validated finding
- Technical report and executive summary
- Prioritized remediation guidance
The proposal defines the assets and access required.
Ask about this plan03ADVANCED PENTEST
Ray-Z Advanced
Custom quoteAn in-depth investigation of connections between applications, access roles and integrations, with analysis across different AI models.
- Multiple roles and tenant isolation
- Connections between weaknesses and systems
- Mobile and related APIs, when in scope
- Detailed action plan and contracted retest
Each pentest has an agreed scope and schedule.
Ask about this planRED TEAM EXERCISES
Red Team
We test a scenario chosen with your team, such as a compromised partner credential. The exercise checks how far that access extends and your team’s ability to detect and respond.
- Agreed scenario
- Coordinated execution
- Detection and response
04 / PENTEST REPORT
Where the flaw is and how to fix it.
You receive a technical report documenting the findings and an executive summary to decide what to address first. Both are included in paid plans.
Severity with a rationale
Priority reflects the demonstrated impact and the conditions needed to exploit the flaw.
Evidence of the finding
Each record shows what was observed and what could not be verified.
Remediation guidance
The system owner receives instructions to fix the issue and verify the result.
RAYZVN — 001
External assessment · executive summary
Vela Norte Commerce
High3 findings
Medium1 finding
RZ-01Data exposure in an API
This sample uses a fictional company and data. It shows the paid report; free Recon provides only finding counts by severity.
05 / AUTHORIZATION AND TESTING
You authorize what we test.
01
Agree on scope
Before starting, we confirm who can authorize testing and which systems are included.
02
Run the tests
We test only authorized assets, within the agreed conditions.
03
Present the results
We deliver finding counts by severity for Recon and a technical report for pentests.
Non-destructive testing.
No denial of service, data deletion or modification. We collect only the minimum evidence needed, within the agreed boundaries.
06 / FREQUENTLY ASKED QUESTIONS
About testing and hiring RAYZ.
Is Recon really free?
Yes. Our technology reduces repetitive reconnaissance work, so we can offer this first step for free. You receive finding counts by severity, with no obligation to buy. Finding locations, evidence and remediation recommendations are included in the paid plans.
Is Recon a complete pentest?
No. Recon examines the authorized external surface and provides finding counts by severity. Ray-Z and Ray-Z Advanced pentests include validation of findings and remediation guidance.
What makes the RAYZ method exclusive?
The exclusivity comes from the investigation system developed by RAYZ, which coordinates the AI models and retains the evidence from each test while the specialist leads the work from surface discovery through to assigning severity to findings.
How do you validate what the AI flags?
Throughout the investigation, the specialist compares the models’ analyses and directs further checks when there are disagreements or gaps, because agreement between AI models does not establish a weakness without evidence of its behavior and impact.
What do I need to provide?
Your company details, professional contact and initial domain. Before starting, we confirm the responsible contact, authorization and boundaries. Do not send passwords or tokens.
Can you test my partners’ systems?
Only with valid authorization for the relevant assets and tests. Your authorization over your environment does not automatically extend to third-party systems.
Do you implement the fixes too?
Pentests include guidance for the responsible team to remediate. Implementation and retests depend on the agreed contract.
When will I receive the result?
We confirm the schedule after reviewing the surface and working conditions. Environment size and complexity affect timing.
Does RAYZ work with larger companies?
Yes. Scope can cover multiple applications, integrations and teams. We align priorities and scheduling with the responsible contacts.
What if no issues are found?
That result is reported too. The absence of findings within a given scope does not certify the security of the entire company.
FREE RECON
Request a Recon for your company.
Enter your domain and professional contact details. Before starting, we confirm the asset owner and the boundaries of the work.
- Counts by severity
- Confidential results
- No obligation to buy
Want to ask a question first?Chat on WhatsApp
Online registration coming soon.
For now, contact Nicolás on WhatsApp to learn about the free Recon.
Request via WhatsAppOnline requests will open once the terms are published. For now, contact us on WhatsApp.