Full-spectrum autonomous red teaming — not just web.
Published 2026-09-11 · Updated 2026-09-13
External apps and APIs are the entry point. From there R0 pivots into on-prem Active Directory, hybrid identity and the cloud — and reverse-engineers the artifacts it finds into working proof.
Autonomous red team use cases across your whole estate
Most autonomous tooling stops at the web tier. R0 runs as a full-spectrum autonomous red team: it reconstructs the API behind an app, escalates through on-prem Active Directory, crosses into Entra ID and hybrid identity, and probes cloud IAM in the same engagement — then chains those findings into one attack path. The case study below walks a single run from an external ADCS relay to an attempted cloud-tenant takeover. See the ADCS ESC8 → DCSync chain in the case study.
Web & API
JS-driven surface reconstruction rebuilds the real API behind the UI, then tests every route for broken access control, IDOR/BOLA, injection and secrets-in-JS — including low-code platforms like Mendix.
On-prem AD & red teaming
Full Active Directory tradecraft: ADCS abuse (ESC1/ESC8), NTLM relay, DCSync, Kerberos attacks, and lateral movement — graphed with BloodHound and executed with NetExec.
Hybrid identity
Entra ID and M365 attack paths: AD Connect / ADSync abuse, seamless-SSO ticket forging, PRT and device-token theft, FOCI token swapping and Conditional-Access boundary testing.
Cloud
Cloud-native workloads across Azure, AWS and GCP — storage exposure, over-broad IAM, weak trust boundaries and privilege escalation between services.
From artifact to working exploit.
When R0 pulls a binary, a mobile app or a firmware image, it doesn’t stop at “interesting.” The model drives disassemblers and decompilers to understand the target, recover logic and secrets, and build the proof that a weakness is really exploitable.
See a full-estate chain, end to end.
Our anonymised case study walks an 11-phase run from an external ADCS relay all the way to an attempted Entra ID takeover — web, on-prem AD and hybrid identity in one autonomous engagement.
See R0 run against
a target of yours.
A continuous, autonomous red team on hardware you own — no data ever leaves the box.