Attacker's-eye security, validated by AI — inside-out & outside-in

The watchtower that proves what's exploitable

heimdallX scans your web, cloud and code like a world-class hacker and proves what's actually exploitable with EPSS, CISA KEV and safe active testing — then watches the outside world, from leaked credentials and dark-web chatter to ransomware, ranked by TALON. Adversary emulation, continuous monitoring and board-ready governance, in one AI dashboard.

Scan your domain free See it in action

No credit card required · Real results in minutes · Cancel anytime

EPSS · KEV

exploitability validation

TALON · ATOM

external-threat scoring

ATT&CK

adversary emulation

24/7

continuous monitoring

01AI agents probe your domain like a real attacker — first findings in minutes

02One benchmarked posture score — know exactly where you stand

03Every critical proven exploitable — EPSS, CISA KEV & safe active testing

04A fix-first queue ranked by what's actually exploitable, not just severity

05Now watching the outside too — leaks, dark web & ransomware, ranked by TALON

One platform, three watchtowers

Most teams juggle a scanner, a breach monitor and a code tool. heimdallX fuses all three into one attack-surface graph — every finding validated for exploitability, correlated inside-out and outside-in, and explained by the same AI analyst.

Web, Cloud & Asset Scanning

Point heimdallX at a domain and an orchestra of AI agents probes it like an attacker would — across web, cloud and exposed services — then proves what's actually exploitable and chains it into real attack paths.

DNS, TLS, headers, tech & cloud posture (CSPM)
Exploitability validation — EPSS · CISA KEV
Safe active testing — proof, not guesses
Attack-surface graph & breach simulation
Continuous monitoring + AI-prioritized fixes

External Threats & Digital Risk Protection

Know what the internet knows about you — and what attackers are already doing outside your perimeter. Continuous DRP across leaks, dark-web & Telegram chatter, ransomware victim posts, brand abuse and malware IOCs, correlated to your assets and distilled into an AI briefing.

Leaked-credential & breach alerts (HIBP)
Dark-web, Telegram & ransomware-site monitoring
Look-alike / phishing brand-abuse detection
Malware & C2 IOCs correlated to your assets
TALON scoring + ATOM account-takeover chains

Code Security

Connect a repository and let AI hunt the business-logic flaws scanners miss, scan your dependencies and secrets, and feed every code CVE into the same exploitability-ranked queue.

Business-logic vulnerability detection
Secret & credential scanning
SCA / SBOM — OSV-matched dependency CVEs
Code CVEs flow into the fix-first queue
AI remediation — PR-ready fix prompts

Beyond detection

Validation, adversary emulation & enterprise controls

Detection is table stakes. heimdallX proves what's exploitable, emulates the adversary, watches your surface around the clock, and ships the governance enterprises require — each with its own deep-dive page.

Exploit validation

Exploitability Validation Core

Stop chasing severity. Rank by what's actually exploitable — EPSS probability, CISA KEV, and proven reachability.

EPSS exploit-probability weighting
CISA KEV known-exploited priority floor
Version-aware CVE matching — zero invented CVEs

Active validation

Proof-based Active Testing

Confirm vulnerabilities by safely triggering them — reflected XSS, error-based SQLi and open redirects, proven not guessed.

Consent-gated, non-destructive GET probes
Reflected-XSS, error-SQLi & open-redirect proof
Same-origin, rate-limited, self-identifying agent

Adversary emulation

Attack Simulation & MITRE ATT&CK

See findings the way an adversary chains them — mapped to MITRE ATT&CK tactics and techniques.

MITRE ATT&CK coverage matrix
Tactic → technique mapping per scenario
Severity-weighted kill-chain view

Continuous EASM

Continuous Attack-Surface Discovery

Watch your external footprint change over time — new hosts, shadow IT and disappearing assets, run after run.

Snapshot + delta across every run
New / gone host detection
Shadow-IT (risky new host) flagging

Software Composition Analysis

Find vulnerable dependencies — most of your risk lives in code you didn't write.

npm + PyPI manifest parsing
OSV-backed vulnerability matching
SBOM inventory · CVEs flow to Validation Core

Live Threat Intelligence

Know what's being exploited in the wild today — KEV, EPSS and emerging-exploit signals wired straight into your queue.

Daily CISA KEV & EPSS feed sync
Emerging-exploit & public-PoC alerts
Auto re-prioritizes findings as threats move

External threat intel · DRP

External Threats & Digital Risk Protection

Watch the outside-in too — leaked credentials, dark-web & Telegram chatter, malware/C2 IOCs, ransomware victim posts and look-alike domains, all correlated to your assets and ranked by TALON.

Leaks, dark web, ransomware, brand-abuse & IOCs in one feed
TALON composite scoring + ATOM account-takeover chains
AI briefing & threat-knowledge graph, gated to Pro / Business

Attack-surface graph

Attack-Surface Graph

See your whole external footprint as one living graph — assets, services, exposures and how an attacker pivots between them.

Live asset ↔ service ↔ exposure graph
Shortest attacker path to crown-jewel assets
Blast-radius view for every finding

Adversary emulation

Attack-Path & Breach Simulation

Chain individual findings into end-to-end attack paths — see how a breach actually unfolds, before it does.

Multi-step exploit-chain construction
Likelihood-weighted breach scenarios
Mapped to MITRE ATT&CK stages

Cloud posture · CSPM

Cloud Security Posture (CSPM)

Catch the cloud misconfigurations attackers love — public buckets, open ports, over-broad IAM — mapped to the same fix-first queue.

Public storage & exposed-service checks
Over-permissive IAM & policy findings
CIS-benchmark aligned, one unified queue

Continuous monitoring

Continuous Monitoring & Alerting

Set it and stay covered — scheduled re-scans, drift detection and alerts the moment your exposure changes.

Scheduled re-scans & DRP collection
Change/drift alerts on new exposure
Routed to Slack, webhook or email

AI Security Analyst

An AI analyst on every finding — it explains the risk, drafts the fix, and answers 'so what?' in plain language.

Plain-language 'why it matters' per finding
One-click PR-ready fix prompts
Ask-anything copilot over your posture

Board reporting

Executive & Board Reporting

Turn technical findings into a board-ready story — posture, business risk and a dated remediation roadmap, one click to PDF.

Auto-generated executive brief
0–30 / 30–60 / 60–90-day roadmap
One-click PDF / CSV export

Workflow & SIEM

Integrations & Workflow

heimdallX fits your stack — Slack, webhooks, SIEM and ticketing — with an API and audit trail behind every action.

Slack, webhook & email alert routing
SIEM / ticketing export via API
Append-only audit log on every action

AI Remediation & Fix

Every finding ships with a clear, PR-ready fix — and a one-click prompt your AI coding agent can apply.

Per-finding fix steps & config snippets
Copy-ready Claude Code fix prompt
Owner routing in fix-first order

Continuous compliance

Continuous Compliance Evidence

Map every finding to the frameworks auditors ask about — with a timestamped evidence trail.

OWASP / PCI-DSS / ISO 27001 / SOC 2 / CIS mapping
Per-control "last checked" freshness
Timestamped evidence trail

AI cost & governance

AI Cost Governance & FinOps

Run AI-driven security at scale without runaway bills — per-workspace token tracking, hard budget caps and an admin operations console.

Per-workspace AI token & cost tracking
Hard budget caps, enforced not just alerted
Admin operations console + audit trail

Enterprise Controls

SSO, SCIM, granular roles and an append-only audit log — the controls security teams must have.

SAML SSO + SCIM provisioning
Granular RBAC (owner / admin / analyst / viewer)
Append-only audit log + team workspaces

Explore all capabilities →

In action

The real dashboard, in action

Not mockups — these are the actual heimdallX views: exploitability validation, adversary emulation and continuous compliance, rendered pixel-for-pixel.

Exploit validation

Exploitability Validation Core

Stop chasing severity. Rank by what's actually exploitable — EPSS probability, CISA KEV, and proven reachability.

Adversary emulation

Attack Simulation & MITRE ATT&CK

See findings the way an adversary chains them — mapped to MITRE ATT&CK tactics and techniques.

Continuous compliance

Continuous Compliance Evidence

Map every finding to the frameworks auditors ask about — with a timestamped evidence trail.

Built on the CTEM loop

Continuous Threat Exposure Management — the model Gartner calls essential for 2026. heimdallX runs the full loop for you, continuously.

1

Scoping

Define the assets and surfaces that matter to your business.

2

Discovery

Continuously find assets, subdomains, services and misconfigurations.

3

Prioritization

Rank risk by exploitability and real-world impact with AI.

4

Validation

Confirm findings are real, not scanner noise.

5

Mobilization

Ship clear, actionable remediation to the right people.

AGPL-3.0

Open source, and a cloud that runs it for you

The platform is AGPL-3.0 on GitHub. Clone it, read every check it runs, and host it yourself for nothing. The cloud is the same product operated for you — with the external-threat feeds, the SOC ingestion pipeline and managed AI that are ours to run.

Self-hosted

AGPL-3.0 · your infrastructure · no limits, no phone-home

Web & exposure scan modules — the whole engine
Findings, fix-first queue, assets, attack surface
EASM discovery, breach simulation, compliance mapping
Integrations + CI gate (SARIF)
Docker Compose and Kubernetes manifests
Bring your own Anthropic key for the AI features

View on GitHub Self-hosting guide →Support the project →

heimdallX Cloud

From $0 · we operate it · everything above, plus

External threats (DRP): dark web, Telegram, ransomware, brand abuse
SOC: metered log ingestion with AI triage
Managed AI credits — no API key of your own
Team workspaces and roles
Updates, backups, uptime and support

Scan your domain free

Self-host in one command

git clone https://github.com/021flow/heimdallx.git
cd heimdallx && cp .env.example .env   # set SESSION_SECRET
docker compose up -d

Requires Docker. Set SESSION_SECRET, then open localhost:6000/app.

AGPL-3.0 — run it, change it, host it. If you offer a modified version as a service, publish your changes.

Pricing that scales with you

Start free. Upgrade when you're ready. Web checkout via Paddle, mobile via in-app purchase — entitlements synced everywhere.

Self-hosted

$0 · AGPL-3.0

Unlimited assets and scans
Web + Exposure modules
Runs on your infrastructure
Docker Compose / Kubernetes
Community support

Free

$0/forever

1 asset
3 scans / month
Web security module
Community support

Starter

$79/month

10 assets
200 scans / month
Web + Exposure modules
SOC: 0.5 GB/day log ingestion
Continuous monitoring
Email support

★

Pro

$299/month

50 assets
1,500 scans / month
All modules incl. Code & Cloud
SOC: 3 GB/day log ingestion + AI triage
Continuous monitoring + alerts
DRP: leak, dark-web & brand
Email support

Business

$999/month

250 assets
10,000 scans / month
All modules incl. Code & Cloud
SOC: 15 GB/day log ingestion + AI triage
Full DRP suite + threat graph
Team workspaces
Priority support

🔒 Web payments are securely processed by Paddle.com.

↻ Subscription plans may renew automatically until cancelled.

By proceeding to checkout, you agree to our Terms of Service, Privacy Policy, Refund & Cancellation Policy.

Frequently asked

Is heimdallX really open source?

Yes — the platform is published under AGPL-3.0 at github.com/021flow/heimdallx. You can read every check the scanner runs, change it, and host it yourself with no licence fee and no asset limit. The AGPL asks one thing in return: if you offer a modified version to others as a network service, publish your modifications.

What do I give up by self-hosting?

The scanning platform is all there. What the cloud adds is the part that has to be operated: the external-threat (DRP) feeds and their subscriptions, metered log ingestion for the SOC pipeline, managed AI credits so you do not need your own Anthropic key, team workspaces, and updates, backups and support.

Can I use the self-hosted edition commercially?

Yes. AGPL-3.0 does not restrict commercial use, including inside a company. The obligation is about distribution and network use of a MODIFIED version — if you change heimdallX and offer that changed version as a service to others, those users must be able to get your source.

What can heimdallX scan?

Domains and URLs you own or are authorized to test. The web module runs real reconnaissance — DNS, subdomains, TLS, HTTP security headers, technology fingerprinting and exposed-service checks — and an AI layer turns the raw data into prioritized, fixable findings.

Is it safe to run against my production site?

Yes. Passive checks are non-intrusive. Active port scanning only runs on assets you've verified you own and explicitly consent to — we never launch intrusive tests without permission.

How is billing handled?

On the web we use Paddle as the merchant of record (cards, taxes, invoices handled for you). In the mobile app, subscriptions go through native in-app purchases. Your plan and entitlements stay in sync across every device.

Do you support Google and Apple sign-in?

Yes — sign in with Google or Apple on web and mobile. Your workspace, assets and scan history follow you across platforms.

What makes the findings different?

Traditional scanners drown you in false positives. heimdallX pairs deterministic checks with an AI analyst that explains why each issue matters and exactly how to fix it — modeled on how elite offensive-security teams work.

See what attackers see — before they do

Run your first scan in under two minutes. Free, no credit card, real findings.

Launch heimdallX

heimdallX — AI Security Platform for Domains, Exposure & Code