About R0
Built by a red team in Rotterdam, not just an AI lab.
R0 is made and run by ReactiveZero, an offensive-security consultancy in Rotterdam. We spend our days breaking into systems for clients. R0 is that tradecraft, packaged into an appliance you can run yourself — with the same team standing behind the results.
Why we built R0
A manual penetration test is a snapshot: a few weeks of a skilled team, once or twice a year, and then your estate keeps changing without them. Scanners fill the gap with noise — long lists of “potential” issues that no one has actually exploited. We wanted something in between: the judgement of a red team, running continuously, proving what is really exploitable, and doing it without shipping a client’s attack-surface data to someone else’s cloud.
So R0 runs a local model as an orchestrator, spawns scoped subagents that drive the same tools we use by hand, and chains what they find into real attack paths — entirely on hardware the client owns. It is the difference between “you have an ADCS misconfiguration” and “here is the certificate we relayed, the domain we took, and the one control that stopped us.”
People own the judgement
R0 is autonomous, not unaccountable. Our consultants scope every engagement with you, set the rules of engagement, review and validate findings, and handle retests. You get autonomous coverage between engagements, with a certified team responsible for what lands in the report. The appliance does the running; people decide what it means.
The consultancy behind it
ReactiveZero delivers penetration testing, red teaming, cloud and code review, digital forensics and incident response for organisations across Europe, including regulated sectors. R0 is the product side of that practice. Read more about the penetration testing consultancy in the Netherlands, our manual penetration testing and red team operations, follow us on LinkedIn, or read the team’s technical write-ups on our research blog.
Where R0 is built and supported: Rotterdam, the Netherlands
R0 is designed, built and supported from Rotterdam, the Netherlands (ReactiveZero, KVK 97512249) — inside the EU, by an EU company, for EU data residency. That location is not incidental: it is why R0 runs on hardware you own in your jurisdiction and why your attack-surface data never leaves for a vendor cloud. Support, updates and the consultants who validate findings all sit in the same jurisdiction as your engagement.
See the team run R0 against a target of yours.
A short call, a real run, and a straight answer on whether it fits your estate.