Built like the evidence
it has to defend.
Go services, PostgreSQL, and a React console — deployed inside your network, updated through signed offline bundles, with an evidence chain nothing outside can touch.
The verification core
Every finding in Kameen earns its verdict through a pipeline the industry is only now converging on: falsify first, re-probe blind, cite evidence character-for-character, then emit a replay artifact that keeps watching for regressions.
Falsify-first
Candidates are actively disproven before they are confirmed — negative controls and independent reproductions, not pattern matches.
Blind re-verification
A second pass re-runs the minimal probe set in a fresh context. Mismatch means probable, never confirmed.
Replay artifacts
Confirmed findings become stored tests. The scheduler re-runs them: passes mark fixes verified, failures flag regressions.
Assessment packs
First-party, safe probes across the estate — no wrapped attack tools, ever.
Perimeter & Host
Service, banner and configuration probing with safe, first-party checks.
Deep TLS
38-rule TLS assessment: cipher suites, protocol flaws, certificate chains, HTTP-over-TLS.
AD Attack Paths
BloodHound-style edges, ADCS ESC audits, Kerberoast and delegation analysis — read-only LDAP.
Web & API
Header-to-app-level web checks and OpenAPI-driven API testing mapped to OWASP.
Network Assets
MAC/ARP ingestion with offline OUI intelligence and rogue-device drift alerts.
OS & Infrastructure Benchmarks
Thousands of CIS/STIG-mapped hardening checks for Linux, Kubernetes, Docker, Windows and databases.
Offline artifact analysis
Assess what customers hand you — images, repositories, configs, forensic collections — with zero contact to production systems.
CI/CD Posture
300+ pipeline rules across GitHub, GitLab and Azure DevOps — offline repo analysis.
Windows Forensics
130 persistence checks over offline registry hives, KAPE and Velociraptor collections.
SBOM & Artifacts
Container images, IaC and repositories: CVEs, misconfigurations, secrets — offline.
Firmware & Binaries
Offline extraction and CVE matching for supplied firmware images and binaries.
The remediation engine
Kameen never mutates your systems. It prescribes machine-actionable fixes, packages them for your tooling, verifies by re-probing, and attests.
Deterministic prioritization
SSVC decision trees, KEV-over-EPSS precedence and CVSS-E per asset criticality. Every ranking is explainable — row by row — and byte-reproducible offline.
Fix packages with rollback
Ansible, PowerShell DSC, GPO backups, Intune policies and patch manifests — idempotent, dry-runnable, and shipped with declared inverse operations.
Campaign math
Cost-weighted set cover turns thousands of findings into a handful of fix actions, ranked by the paths to Domain Admin they sever.
See what's actually exploitable.
Book a walkthrough with your own scope, or explore the seeded demo first. Either way: verified findings, sealed evidence, proven fixes.