Guardian Probe is continuous, fully managed penetration testing across your external attack surface, internal network, and application layer. Guardian’s security team runs the full engagement: scoping, testing, triage, remediation guidance, verification, and reporting. The Guardian Probe platform, AI-augmented and built on an open-source detection ecosystem, powers the testing.
Every finding Guardian delivers is proven exploitable. Every fix becomes a permanent regression check.
01 · Guardian Probe
What Probe Tests
Probe covers three areas, each with its own coverage and access requirements.
External Discovery
Continuous reconnaissance and attack surface mapping across your domains, IP ranges, and publicly accessible infrastructure. No credentials required. Coverage includes DNS and subdomain enumeration, live host discovery and HTTP/S fingerprinting, port scanning and service identification, SSL/TLS configuration analysis, and certificate transparency monitoring. Discovery also identifies exposed APIs, admin panels, and login portals, along with shadow IT, misconfigured cloud storage, and unintended exposures.
External Penetration Testing
Active exploitation of the assets discovery identifies, from an unauthenticated external perspective with no prior knowledge of your environment. Scope includes web applications (OWASP Top 10 and beyond), REST and GraphQL APIs (authentication, authorization, and injection), business logic flaws, credential stuffing, authentication bypass, session management, cloud misconfigurations reachable from the perimeter, and CVE exploitation against identified service versions.
Internal Network Penetration Testing
Internal testing runs from the Guardian Secure Gateway or from a host you provided, physical or virtual, where Guardian deploys its internal scanner. Testing is scoped to agreed network segments only. Coverage includes host discovery and service enumeration, Active Directory and identity infrastructure, lateral movement and privilege escalation, internal web applications and APIs not exposed externally, segmentation validation between network zones, credential exposure and hash capture, unpatched systems and exploitable services, and internal exposure across cloud and hybrid environments.
02 · Guardian Probe
How Findings Are Delivered
Every finding, external or internal, includes a working exploit, full HTTP traces, and step-by-step reproduction procedures. Guardian does not submit theoretical risk ratings without proof of exploitability.
Guardian analysts review all findings, filter false positives, assign severity ratings, and prioritize remediation guidance by business risk. Each finding report includes the exploit proof, HTTP traces, severity rating, CVSS score, EPSS score and remediation guidance.
03 · Guardian Probe
Engagement Structure
Probe runs on a 12-month term in three phases.
Initial Pentest. Full external discovery, external pentest, and internal pentest within the first 30 days, with a complete findings report and remediation guidance. Testing launches within 10 business days of contract execution, once access is in place.
Verification Pentest. A targeted retest of every Phase 1 finding after your remediation cycle, roughly 45 to 60 days after Phase 1 delivery. Confirms fixes held and sets regression baselines.
On-Demand Monthly Pentests. Up to one full pentest per calendar month for the rest of the term, launched at your request. Scope can cover the full environment or specific assets you direct. Unused months do not carry forward.
Testing can also run on a set schedule or, with CI/CD integration, on every deploy.
04 · Guardian Probe
Regression and Context
Every remediated finding becomes a permanent regression check. Probe connects to your CI/CD environment, scans the running application, and compares it against what’s in the repository. When code changes, past exploits are retested automatically. Probe also connects to major cloud providers, including AWS, Azure, and GCP, along with Kubernetes, to inventory and scan cloud assets. Probe carries your architecture, business logic, user roles, and past findings across every engagement, so testing doesn’t restart from zero each cycle.
New CVE detections are often available within hours of public disclosure, drawing on vulnerability knowledge contributed by more than 100,000 security researchers.
05 · Guardian Probe
Between Tests
Between formal testing cycles, Guardian passively monitors your external attack surface for new subdomains and assets, certificate transparency events indicating new domain registrations, newly published CVEs that match your identified service versions, and changes in service exposure or configuration drift.
06 · Guardian Probe
How It’s Managed
Guardian operates the platform and handles scoping, triage, remediation guidance, verification, reporting, and ongoing monitoring. All Probe data rolls into Guardian’s AttackSOC™ continuously, so analysts monitor, alert on, and triage findings as they’re identified.
Remediation follows one of three models. Your team can work findings directly in the Probe portal, Guardian can assist your team through the fix, or Guardian can remediate on your behalf. Remediated findings are retested, verified fixes are closed, and failed remediations are escalated with updated guidance.
Your team names a technical point of contact, joins kickoff and reporting review calls, and provides a host for the internal scanner if you’re not using the Guardian Secure Gateway
07 · Guardian Probe
Access and Rules of Engagement
Internal access is logged, audited, and limited to agreed network segments.
08 · Guardian Probe
Reporting
Attack Surface Inventory: all discovered external assets, services, and exposures with current status
Finding Reports: delivered continuously through the platform
Executive Summary Report: monthly summary of security posture, risk trends, open findings, and remediation progress
Technical Detail Report: all active and resolved findings, tool output, and testing methodology
Remediation Verification Reports: confirmation for each closed finding, with regression test results
Risk Trend Dashboard: ongoing access to open findings, remediation status, and coverage
Compliance Mapping: findings mapped to NIST CSF, CIS Controls, and PCI-DSS as applicable
Findings can also flow into the tools your team already uses, with integrations for ticketing platforms such as Jira, GitHub, and GitLab, and alerting through Slack, Microsoft Teams, email, or custom webhooks.
Reports and reviews happen monthly at a minimum.
09 · Guardian Probe
How Probe Fits
Probe complements Guardian Glass. Glass runs a lighter scan across network, DNS, and applications. Probe goes deeper, testing externally and internally and mapping findings to CVEs and EPSS scores
10 · Guardian Probe
Scoped Separately
Mobile application testing and source code or pull request security review are available as add-on scopes. Social engineering, phishing simulation, physical security testing, and third-party, SaaS, or partner-hosted environments are out of scope unless separately authorized.