Skip to content
MIZANIC
Agentic pentesting Human-in-the-loop Preview · in engagements

Naqid

/ˈnɑː.qɪd/ · Arabic: the critic. The one who probes.

An agent-driven testing platform that probes your web, API, and cloud surfaces. Senior engineers review and approve each action: the AI scales the probing, the team scales the judgment. Every step logged, reproducible, and tied to a finding chain you can hand to auditors. In preview with fintech and healthcare engagements today.

Request access See coverage
Naqid architecture: agentic wrapper on top of the Naqid CLI, with an inline HITL gate Naqid is one system with two stacked layers: an agentic AI wrapper that plans the next testing action, and the Naqid CLI underneath that executes it. Between the two, the HITL gate has a senior engineer approve every proposed action before the CLI runs it. The CLI probes external targets; their response flows back up. Audit chain captures every transition as the chain-of-evidence deliverable. NAQID cli + agentic wrapper AGENTIC WRAPPER plans next action · reasons over results orchestrator · tool-use · context HITL · GATE senior engineer reviews each proposed action approve · reject · edit NAQID CLI testing engine · executes the approved action $ naqid recon --scope api.example.com $ naqid probe --idor /api/v2/orders $ naqid chain --auth-bypass + privesc [+] 4 findings · 2 critical · chain validated $ ▌ TARGETS EXTERNAL · YOUR SURFACES UNDER TEST web api cloud AUDIT CHAIN EVERY STEP RECORDED repro · cvss · evidence · the deliverable · PROPOSE APPROVED PROBE RESPONSE RESULT no re-approval on return LOG

The shift

Pentesting at full attack-chain depth.

Naqid simulates the full attack lifecycle: reconnaissance, initial access, privilege escalation, lateral movement, exfiltration. Senior engineers review every step before it runs.

Recon Initial access Privilege escalation Lateral movement Exfiltration
5
phases of the attack lifecycle simulated per run: recon, initial access, privilege escalation, lateral movement, exfiltration.
100%
of agent actions reviewed by a senior engineer before they run.
0
tool dispatches without explicit human approval.

Coverage

What Naqid tests.

Application surface

Authentication, authorization, session, injection, business-logic flaws, modern SPA quirks. OWASP top-10 as the floor, with modern SPA and business-logic depth on top.

Service surface

Contract drift, broken authorization, rate-limit bypass, mass assignment, server-side request forgery. REST, GraphQL, and gRPC.

Infrastructure surface

IAM misconfigurations, public-exposure detection, secret leakage, drift from secure baselines, supply-chain checks across AWS-native services.

How it works

Behind each Naqid run.

naqid · recon session
$ naqid scan --target api.acme.example --profile web-api
resolving scope … 3 hosts · 41 routes · auth matrix admin ↔ viewer
[CRIT] IDOR on /v1/invoices/:id · cross-tenant read confirmed
[HIGH] refresh token accepted with alg=none on /v1/auth/refresh
[MED] missing rate limit on /v1/otp/verify
replaying 3 findings against staging … 3/3 reproduce
✓ report ready: 3 findings · evidence attached · audit-grade

Attack-chain simulation

Real attacks unfold across phases: reconnaissance, initial access, privilege escalation, lateral movement, exfiltration. Naqid simulates the full chain end to end.

Offensive agentic AI

Frontier models probe permutations a human can't enumerate. The agent maps the surface, hypothesises an attack path, runs the probes, and chains successful steps.

Auditable & reproducible

Every finding is validated, reproduced, and documented. Naqid produces a full audit log and step-by-step repro your team can re-run independently.

Human-in-the-loop

Agents are fast. Senior engineers are what makes the speed useful. Each action is reviewed and approved before it runs.

Output

Findings, in plain English.

Every validated finding lands in a written report with reproduction steps, suggested remediation, CVSS score, and a mapping to the relevant compliance control. Findings can be routed into your tracker on request. The audit-grade chain is the deliverable.

Teams remediate faster because the finding ships with the evidence to act on it.

Sample Naqid finding: IDOR in /api/v2/orders, validated and recorded on the audit chain NAQID AGENTIC PENTESTING VALIDATED F-2847 HIGH 14m ago IDOR in /api/v2/orders api · authz · cross-tenant exposure surface api method GET /api/v2/orders/{id} cvss 8.1 (high) repro 2 steps · harness ✓ fix tenant scope on read mapped HIPAA 164.312 AUDIT CHAIN · 4 STEPS recon enumerated /api/v2/orders probe discovered IDOR pattern chain cross-tenant PoC executed review senior engineer · approved REPRODUCIBLE · HARNESS ATTACHED today's run surfaces tested: web · api · cloud 47 steps logged · 4 envs · audit-grade

Engagement model

Two ways Naqid runs in your engagement.

Same operator, same audit-grade output. The choice is topology: runs in your AWS, or in ours.

Naqid runs in your AWS account

Naqid running inside your AWS account, operated by a Mizanic senior engineer from outside; audit chain stays in your perimeter. SENIOR ENGINEER · MIZANIC YOUR AWS ACCOUNT naqid runs inside your perimeter approves NAQID cli + agent YOUR APPS web · api · cloud probe AUDIT CHAIN · stays in your perimeter

Operated by our senior engineers as part of the engagement. Findings, audit log, and the evidence chain stay inside your perimeter.

Naqid runs in ours

Naqid runs in Mizanic's environment with a senior engineer, probing your surface under your approval gates; audit chain delivered to you. MIZANIC ENV we host naqid NAQID cli + agent senior engineer approves each step YOUR SURFACE under your approval gates YOUR APPS web · api · cloud probe AUDIT CHAIN · delivered to you

We host Naqid in our environment and run it against your surface under your approval gates. Faster to start; the audit chain is delivered to you at engagement close.

Access

Request access to Naqid.

Drop your email. We'll send a confirmation link and reach out as access opens up to new accounts.

Case study

See how a client uses Naqid in production.

Drop your email. We'll send you a link to the PDF. The link expires in 24 hours.

Naqid FAQ

Common questions about agentic pentesting.

How is Naqid different from a vulnerability scanner?
A scanner reports surface-level findings (open ports, known-CVE software, missing headers) and that's its scope. Naqid is agent-driven offensive testing operated by senior engineers; it chains findings, attempts exploitation under human approval, and validates whether a finding is actually exploitable in your environment before it ships. Fewer false positives, more real findings, mapped to the compliance control they evidence.
Does Naqid replace annual penetration tests?
For most regulated industries it complements them; your auditor likely still wants the annual report. During a Naqid engagement, the big findings in scope are caught, triaged, and remediated, so the annual run lands as a confirmation of the hardening.
What attack surfaces does Naqid cover?
Three: web (authentication, authorization, session, injection, business-logic flaws, modern SPA quirks), API (contract drift, broken authorization, rate-limit bypass, mass assignment, SSRF, across REST, GraphQL, and gRPC), and cloud (IAM misconfigurations, public-exposure detection, secret leakage, drift from secure baselines, supply-chain checks across AWS-native services).
How do findings come back?
As a written report per engagement: title, CVSS plus business context, step-by-step reproduction with a harness, suggested remediation, and a compliance framework mapping (HIPAA, PCI, SOC 2, ISO 27001). Validated findings can be routed into your tracker (Jira, Linear, ServiceNow) on request. The audit-grade chain is the engagement deliverable.
Can we start in staging before opening up production?
Yes. Naqid is configured per engagement with rate-limits, exploit-mode toggles, and blast-radius controls. Most engagements start in staging or a sandbox account, validate the finding shape, then expand to production under tighter guardrails.

Ready to put Naqid on your surfaces?

Drop your email below. We'll confirm and reach out as access opens up.

Request access