EREBUS
EN

Hack yourself first.

For the people testing systems—and the people responsible for what happens next.

Map paths to sensitive data. Run a scoped engagement. Keep the evidence and the remediation work in one place.

EREBUS / ENGAGEMENT 001ILLUSTRATIVE EXAMPLESkip walkthrough

THE PATH, THE PROOF, THE WORK

Follow one engagement.

01/ 09
01 / AUTHORIZEScroll down to move through the engagement

Begin with the objective, the boundary and the operator’s authority.

Step 1 of 9. Scope signed.
One authorized path.The evidence behind it. The work to close it.
01

Operator-signed scope

The objective, boundary and authority.

02

Manual and agent control

Every action in the same engagement.

03

Evidence-linked remediation

The proof, approved change and retest.

Read the full example
  1. 01 / 09SCOPEAuthorization

    01 / AUTHORIZE

    EXAMPLE

    Scope signed.

    Begin with the objective, the boundary and the operator’s authority.

    EXAMPLE EVIDENCE
    scope-record.json
    DECISION / NEXT WORK
    Confirm targets, exclusions and operator authority.
  2. 02 / 09EDGE-01Public edge

    02 / TRACE THE PATH

    EXAMPLE

    EDGE-01

    The public entry point anchors this example route into the environment.

    EXAMPLE EVIDENCE
    surface-observation.json
    DECISION / NEXT WORK
    Confirm ownership and the authorized boundary.
  3. 03 / 09WEB-01Application

    02 / TRACE THE PATH

    EXAMPLE

    WEB-01

    An application relationship connects the public edge to a deployment identity.

    EXAMPLE EVIDENCE
    application-review.json
    DECISION / NEXT WORK
    Review how the application obtains deployment access.
  4. 04 / 09SVC-DEPLOYIdentity

    02 / TRACE THE PATH

    EXAMPLE

    SVC-DEPLOY

    A deployment identity connects the application to the delivery pipeline.

    EXAMPLE EVIDENCE
    permission-review.json
    DECISION / NEXT WORK
    Remove unused deployment permission.
  5. 05 / 09CI-01Deployment

    02 / TRACE THE PATH

    EXAMPLE

    CI-01

    The delivery pipeline links the deployment identity to a production workload.

    EXAMPLE EVIDENCE
    pipeline-access.json
    DECISION / NEXT WORK
    Restrict who can change or trigger deployments.
  6. 06 / 09K8S-PRODWorkload

    02 / TRACE THE PATH

    EXAMPLE

    K8S-PROD

    The workload has a relationship to the regulated data store in this example.

    EXAMPLE EVIDENCE
    workload-access.json
    DECISION / NEXT WORK
    Review workload access to regulated data.
  7. 07 / 09PII-STORERegulated data

    02 / TRACE THE PATH

    EXAMPLE

    PII-STORE

    The data store is the endpoint of the examined route. No real data is accessed.

    EXAMPLE EVIDENCE
    scoped-impact-record.json
    DECISION / NEXT WORK
    Confirm the route is closed after the approved change.
  8. 08 / 09FIXApproved change

    03 / REMEDIATE

    EXAMPLE

    Change approved.

    Review the evidence and approve a change to the relationship that enables the path.

    EXAMPLE EVIDENCE
    approved-change.json
    DECISION / NEXT WORK
    Remove the SVC-DEPLOY → CI-01 permission. Example only.
  9. 09 / 09RETESTVerification

    04 / RETEST

    EXAMPLE

    Path interrupted.

    The example retest closes the examined route. The record stays attached to the work.

    EXAMPLE EVIDENCE
    retest-record.json
    DECISION / NEXT WORK
    This example route is interrupted. Other paths still require assessment.

01 The decisions

One technical record.
More informed decisions.

Exposure matters to the team testing it, the people fixing it, and the people taking responsibility for it. Erebus gives those conversations a common technical record.

Security & red teams

What can an attacker actually reach?

Trace relationships across assets and identities. Attach proof to findings, then retest the approved change.

For internal security teams and authorized labs.

CTOs & engineering

What work should we prioritize?

Connect an exposure to the affected systems and the remediation it needs. Give engineering a record it can act on.

For technical leaders and remediation owners.

Acquisitions & diligence

What are we taking on?

Use authorized technical findings to inform diligence questions, remediation discussions and post-acquisition planning.

For deal advisers, acquirers and portfolio operators.

MSSPs & consultancies

What can we stand behind?

Keep scope, operator actions, evidence and the fix list together through a client engagement and its handoff.

For testing providers and technical advisers.

Acquisition use requires the target owner’s authorization. Findings can inform a wider assessment; financial valuation and remediation estimates remain the responsibility of the relevant advisers.

02 Operator control

The agents move.You set the limits.

You define the boundary and sign the scope. Manual actions and agent work share the same authorization record.

Illustrative

Operator authorization

Scope of engagement

Objective
What to establish
Targets
What is in scope
Exclusions
What stays out
Time window
When work is authorized
Constraints
How work may proceed

Authority recorded

Operator-signed.

The runtime re-reads this record before launch.

Manual actions
Agent work

When the scope changes

New scope. New approval.

Editing the scope clears its signature. The operator must approve the revised scope.

Remediation remains the engagement owner’s decision.

Start with the example scope

03 The execution team

Specialist work.
A shared engagement.

One orchestrator coordinates eleven specialists. Work the graph yourself or direct the agents; findings and evidence stay connected to the same engagement.

Explore the team

11 specialists

01Map the estate

02Test the path

03Establish the record

04Investigate further

Select a role to explore its responsibility.

04 The working record

The finding is only the beginning.

A useful engagement explains what happened, what it means and what needs attention. Erebus keeps the route, supporting evidence and remediation decision connected.

Engagement record 001 / Example

erebus-example-record.json

  1. 01What was found

    An unused deployment permission links SVC-DEPLOY to CI-01.

    Evidence reference

    permission-review.json

  2. 02What needs to change

    Remove unused deployment permission from SVC-DEPLOY to CI-01.

    The engagement owner reviews and approves the proposed change.

    Deployment access / Example

    Permission present

    From deployment identity SVC-DEPLOY to delivery pipeline CI-01.

    Owner decision

    Illustrative approval only

  3. 03What the retest shows

    The example route is interrupted.
    No real test performed.

    Check whether the examined path remains after the approved change.

Scope and authorizationView details

The objective, exclusions and illustrative authorization recorded for this example.

Objective
Assess an example path from public edge to regulated data
Excluded from scope
billing/* · prod-db-02
Authorization
Illustrative operator signature; not real authorization

Selected excerpts from the example.

That gives operators a trail to inspect, engineering a fix to review, and decision-makers a technical basis for the next conversation.

05 The record keeper

Meet EREBUDDY

He does the work.You keep the records.

Your buddy, capturing every engagement session in real time.Documentation is half the work—he does it for you.

06 Before you begin

A few clear answers.

The peopleWho is Erebus built for?

For teams running authorized offensive security engagements.

Security teams, MSSPs and authorized labs. The evidence and remediation record can also support technical leaders, due-diligence advisers and acquisition teams working with an authorized operator.

The authorityDo the agents decide what they can test?

No. The operator declares and signs the scope.

The orchestrator coordinates work within that engagement. A change to scope clears its signature and requires renewed authorization.

The decisionCan findings inform an acquisition?

Yes—when the target owner authorizes testing.

Technical findings can inform diligence questions and post-acquisition remediation planning. Erebus is not a valuation model, a cost estimator or a complete financial, legal or cyber due-diligence service.

The exampleIs the workspace above a live engagement?

No. The workspace is an interactive example.

Its entities and evidence are illustrative. Exploring the graph and comparing authorization or remediation states does not connect to a system or execute a security test.

The accessWhat does private preview involve?

Private preview is available by invitation.

Erebus Cloud is a managed control panel for authorized engagements. Talk to the team to learn how Erebus could fit your environment and discuss access.

07 Start a conversation

You own the decision.Make it with evidence.

Give your team a record they can stand behind—and yourself a clear basis for what happens next.

Talk to the team about the question you need to answer.

  • Your question.

    What you need to understand: exposure, remediation or technical risk.

  • Your scope.

    The environment, objectives and boundaries of the work.

  • Your next step.

    Whether Erebus fits your team and the engagement you have in mind.

Contact form

Talk to the team

Share a few details and the question you would like to discuss.

hello@mlksec.com — Submitting opens your email app. Nothing is sent automatically.

Talk to the team