# R0 by ReactiveZero

> R0 by ReactiveZero is an on-prem autonomous penetration-testing appliance. A local model running on NVIDIA DGX Spark hardware you own orchestrates scoped subagents that drive real offensive tooling across web, API, cloud, hybrid identity and on-prem Active Directory, correlates findings into CVSS 3.1-scored attack chains and records every step in an append-only ledger. No vendor cloud; air-gap capable.

R0 is built and operated by ReactiveZero (KVK 97512249), an offensive-security consultancy at Admiraliteitskade 50-923, 3063 ED Rotterdam, the Netherlands — https://reactivezero.com/ — info@reactivezero.com, +31 10 322 0229. "R0" here is the security appliance, not the epidemiological reproduction number.

Key facts
- Deployment: self-hosted appliance in your rack; local model; no vendor cloud control plane; air-gap capable; updates applied on your schedule.
- Coverage: web and API, cloud (Azure, AWS, GCP), hybrid identity (Entra ID, AD Connect), on-prem Active Directory, reverse engineering.
- Safety: strict scope guard, non-destructive by default, kill switch, approval gates, append-only replayable ledger.
- Evidence: demonstrated attack chains with reproducible steps, CVSS 3.1 vectors and detection mappings; suitable for NIS2 Article 21, DORA TLPT / TIBER-NL and ISO 27001 evidence.
- Hardware: NVIDIA DGX Spark (GB10 Grace Blackwell); more units = more parallel subagents.
- Pricing: on request; demo and scoped pilot first. Availability: pre-order waitlist.

## Product
- [Home](https://reactivezero.ai/): on-prem autonomous penetration testing appliance
- [How it works](https://reactivezero.ai/how-it-works.html): agentic pentesting — orchestrator, subagents, shared blackboard
- [Two-layer model](https://reactivezero.ai/two-layer.html): deterministic sweep plus LLM-driven depth, no step cap
- [Deployment](https://reactivezero.ai/deploy.html): self-hosted, air-gapped appliance on NVIDIA DGX Spark
- [Use cases](https://reactivezero.ai/use-cases.html): web, API, cloud, Entra ID, Active Directory
- [Controls and audit](https://reactivezero.ai/controls.html): scope guard, kill switch, replayable ledger
- [Case study](https://reactivezero.ai/case-study.html): anonymised autonomous run — ADCS relay to a Global Admin credential in ~25 minutes, stopped by phishing-resistant MFA
- [Compliance](https://reactivezero.ai/compliance.html): NIS2, DORA TLPT, ISO 27001 evidence; EU data residency

## Company
- [About](https://reactivezero.ai/about.html): built by the ReactiveZero red team in Rotterdam
- [How to buy](https://reactivezero.ai/how-to-buy.html): pilot, pricing model, delivery
- [FAQ](https://reactivezero.ai/faq.html): safety, data residency, comparison with NodeZero / Pentera, cost
- [Book a demo](https://reactivezero.ai/demo.html)
- [ReactiveZero consultancy](https://reactivezero.com/): manual penetration testing and red teaming in the Netherlands
- [Research blog](https://blog.reactivezero.com/)

## Optional
- [security.txt](https://reactivezero.ai/.well-known/security.txt)
- [Sitemap](https://reactivezero.ai/sitemap.xml)