Question 1

What is CyberArmy AutoFix?

Accepted Answer

AutoFix is an agentic AI security remediation platform that sits on top of the security tools you already run. Six specialized agents close the loop: discover, prioritize, generate, apply, deploy, rollback. Every fix is validated before it ships, deployed through your CI/CD, and verified in production with instant rollback armed. A CISO approval gate sits on every fix.

Question 2

Does AutoFix replace my existing security tools like Wiz, Snyk, or Tenable?

Accepted Answer

No, and that is the point. Those tools are excellent at finding problems. AutoFix sits on top of them, ingests their findings alongside our own scanners, dedupes across every source, and owns the last mile: the fix gets merged, deployed, and verified in production. We complement your stack. No rip and replace.

Question 3

Is AutoFix fully autonomous? Who approves the fixes?

Accepted Answer

Every auto-fix is human-gated today. The Generate, Apply, Deploy, and Rollback stages each carry an explicit approval gate, and every proposed fix comes with an AI explainability report covering root cause, fix rationale, and risk reduction. You approve with one click. Autonomy expands as trust grows.

Question 4

What does Never Break Prod™ mean?

Accepted Answer

Before any fix touches your real environment, AutoFix applies it in isolation, runs your full regression suite, and checks compliance. Only a verified, regression-free fix gets deployed, and it is verified again in production after deploy. If anything unexpected surfaces, rollback fires in under 60 seconds.

Question 5

What happens if a fix causes a problem in production?

Accepted Answer

The Rollback Agent watches every deploy: latency, error rates, failed health checks. If anything drifts, it rolls back in under 60 seconds and the finding goes back into the queue with the new evidence attached. Zero downtime, zero data loss, and a full audit trail of what happened and when.

Question 6

How does AutoFix decide what to fix first?

Accepted Answer

Not by raw CVSS score. AutoFix combines CVSS, EPSS exploitability, asset criticality, and blast radius, and it reads what your team has already accepted, suppressed, or prioritized in your existing tools to infer your real risk-acceptance policy. The queue reflects what actually matters in your environment, not a generic severity list.

Question 7

What categories of risk does AutoFix cover?

Accepted Answer

AutoFix covers CVEs in OS packages, libraries, and containers; cloud/Kubernetes/IaC misconfigurations; hardcoded secrets and API keys; compliance gaps (SOC 2, PCI-DSS, HIPAA, CIS); and overprivileged IAM policies. CVE patching and package upgrades. Cloud misconfiguration remediation. Secret rotation and removal. IAM policy tightening. Compliance evidence generation

Question 8

How is AutoFix priced?

Accepted Answer

You pay for fixes, not seats: an annual platform fee as the predictable base, with per-fix pricing as you expand. AutoFix is in early access for enterprise design partners. Contact us to discuss your environment.

Question 9

Does AutoFix require agents or credentials?

Accepted Answer

AutoFix integrates with your existing infrastructure via read-only connectors to AWS, GCP, Azure, GitHub, Kubernetes, and your CI/CD pipeline. No persistent agents are required.

Question 10

What is a software supply chain attack?

Accepted Answer

A supply chain attack targets the packages, libraries, or tools your code depends on rather than your systems directly. Recent examples include the Axios npm attack (March 2026, affecting 100M+ weekly downloads with a remote access trojan), the Shai-Hulud worm (Sept 2025, spreading across 500+ packages and stealing cloud secrets), and the Chalk/Debug compromise (Sept 2025, 18 packages including chalk and debug hijacked via phishing, exposing 2 billion+ weekly downloads). AutoFix continuously monitors your dependency tree and auto-patches compromised packages before they reach production.

Question 11

How does AutoFix protect against supply chain attacks like the Axios npm incident?

Accepted Answer

AutoFix monitors package manifests and lockfiles continuously against live threat feeds including npm advisories, OSV, and the CVE database. When a malicious version appears - like Axios 1.14.1 and 0.30.4 in March 2026 - AutoFix detects the compromise, identifies every service that depends on it, generates a pinned upgrade to a safe version, validates it, and deploys. The entire cycle takes minutes rather than days.

Question 12

Can AutoFix detect worm-style attacks like Shai-Hulud or the Chalk/Debug compromise?

Accepted Answer

Yes. AutoFix detects version anomalies, unexpected package republications, and behavioral signatures of malicious packages. The Shai-Hulud worm (Sept 2025) self-propagated by stealing cloud secrets and republishing infected packages. The Chalk/Debug attack (Sept 2025) compromised 18 packages with 2 billion+ weekly downloads via maintainer phishing. AutoFix cross-references your dependency tree against known indicators of compromise and patches automatically.

Question 13

What is AI penetration testing?

Accepted Answer

AI penetration testing uses autonomous agents to do what a human pentester does: enumerate your attack surface, attempt real exploitation, and document evidence. Hundreds of agents work in parallel, so a full external pentest finishes in about 20 minutes instead of weeks, and it can run on every release instead of once a year.

Question 14

Is AutoScan a real penetration test or just a scanner?

Accepted Answer

It's a real penetration test. AutoScan AI agents actively attempt to exploit vulnerabilities. Default credentials are tried, SQL injection payloads are sent, SSRF is tested. Every finding in the report has real exploitation evidence, not theoretical risk scores.

Question 15

How is an AI pentest different from a vulnerability scanner?

Accepted Answer

A scanner flags theoretical issues by version-matching and produces false positives that burn analyst time. AutoScan actively exploits: it sends the SQL injection payload, tries the default credentials, tests the SSRF. If it could not exploit the issue, the issue does not appear in the report. Zero false positives by construction.

Question 16

How fast is an AI pentest compared to a traditional engagement?

Accepted Answer

A traditional engagement takes 4 to 8 weeks from scoping to report; a manual cycle of find, fix, retest, and sign off takes a quarter. AutoScan delivers an auditor-ready report in about 20 minutes, and a re-test after your fixes takes minutes, so the whole cycle compresses to under a week.

Question 17

Will my auditor accept the AutoScan report for SOC 2 or ISO 27001?

Accepted Answer

Yes. The PDF report documents scope, methodology, findings with evidence, and remediation guidance. The same structure auditors expect from a traditional pentest engagement. It's designed specifically for compliance use.

Question 18

How does domain verification work?

Accepted Answer

You add a DNS TXT record to your domain, the same way Google Search Console and Cloudflare verify ownership. This proves you have the right to authorise testing. We never scan a domain you have not verified.

Question 19

What is covered in a AutoScan pentest?

Accepted Answer

AutoScan tests your full external attack surface. OWASP Top 10: active exploitation. TLS/SSL weaknesses and certificate issues. DNS misconfigurations and subdomain takeover. Cloud misconfigs: S3, GCS, Azure storage. Security header gaps. Email security: SPF/DKIM/DMARC

Question 20

What's the difference between AutoScan and Pentera/NodeZero?

Accepted Answer

Pentera and NodeZero start at $20K-$100K/year for enterprise security teams. AutoScan targets startups and growing companies who need the same quality of testing without a six-figure budget. Same external attack surface coverage, a fraction of the cost.

Question 21

How is AutoScan priced?

Accepted Answer

AutoScan is in early access. Contact us to discuss pricing and get set up.

Question 22

Will a AutoScan scan affect my production systems?

Accepted Answer

Scan rates are conservative and capped at 1,000 packets/second for port scanning. All exploitation attempts use standard techniques a real attacker would use, designed to find vulnerabilities rather than cause downtime.

Question 23

How do AutoScan and AutoFix work together?

Accepted Answer

AutoScan finds and proves exploitable issues from the outside. AutoFix fixes them at the code and infrastructure level, validates each fix before it ships, and re-tests after deploy. Confirmed findings become permanent regression tests, so a fixed issue cannot quietly come back. Find, fix, verify, lock in.

Question 24

What data does Cyber Army collect?

Accepted Answer

For AutoScan: only publicly visible information from your verified domain: DNS records, TLS metadata, HTTP headers, open port observations, and exploitation evidence. No user data or private application content. No PII from your users or application data. No data behind authentication or access controls. Evidence stored to power findings and reports

Question 25

Where is data stored and can we request residency?

Accepted Answer

Data is stored in secure cloud infrastructure with encryption in transit and at rest. US and EU residency options are available on Enterprise tiers.

Question 26

Do you support SSO and enterprise auth?

Accepted Answer

Yes. Enterprise tiers support SAML 2.0 SSO, SCIM provisioning, and role-based access control for security teams and CISO-level dashboards.

Question 27

What integrations are available?

Accepted Answer

AutoFix integrates with AWS, GCP, Azure, GitHub, GitLab, Jira, PagerDuty, Slack, and custom SIEM/SOAR platforms. AutoScan exports findings to Jira and provides a full JSON API.

Question 28

How do we get started?

Accepted Answer

For AutoScan: sign up, verify your domain, and your first free scan starts immediately. For AutoFix: request a demo and we will run a live proof of concept on your environment.

Question 29

What are the most common cyber threats for mid-market companies today?

Accepted Answer

The most common attack vectors against mid-market and enterprise companies: Credential theft via phishing and password reuse. Exposed secrets and API keys in code or configs. Cloud and IaC misconfigurations. Unpatched internet-facing services. Supply-chain compromise via third-party dependencies. Ransomware via flat networks and over-privileged IAM

Question 30

How do we defend against phishing and BEC?

Accepted Answer

Layer technical controls with process verification. SSO with FIDO2/passkey MFA, disable legacy auth. SPF, DKIM, DMARC enforced to reject policy. Verify wire transfers and access changes out-of-band. Password manager, blocks auto-fill on lookalike domains

Question 31

What is Zero Trust and do we need it?

Accepted Answer

Zero Trust means always verify, least privilege, assume breach. Practical starting points: SSO + phishing-resistant MFA on every service. Device posture checks before access. Network segmentation and micro-segmentation. Continuous monitoring for lateral movement

Question 32

How often should we run a penetration test?

Accepted Answer

At minimum annually and after major releases or architectural changes. With AutoScan you can run continuous monthly tests, matching attacker cadence rather than annual compliance checkboxes.

Common questions.

Still have questions?